General

  • Target

    564508cbfae2c08aec669e47219f9b00

  • Size

    626KB

  • Sample

    231226-fnjzjahcfn

  • MD5

    564508cbfae2c08aec669e47219f9b00

  • SHA1

    36f867db04e9f8a9c9b585df26ba1f4391a0ccbf

  • SHA256

    f27c4430f40881602df511b48cd0704e0c4050a0ef1d8f0b920f8b7d0da77b96

  • SHA512

    c35b9bc7a6662d52d570a9fcf6f825603d72471375f25598d1dd0112312c729cca0fb3089bedbb84678215e8f8a4c9770af3933aa40133edd90957e8ba36c7b4

  • SSDEEP

    12288:buAfiG2zVQxaZ9NE+g3pTCrIq6J+5SvYvXIo+CHz1FZzPyimdcEp:6AatzGUcuMCb

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

q4kr

Decoy

realmodapk.com

hanoharuka.com

shivalikspiritualproducts.com

womenshealthclinincagra.com

racketpark.com

startuporig.com

azkachinas.com

klanblog.com

linuxradio.tools

siteoficial-liquida.com

glsbuyer.com

bestdeez.com

teens2cash.com

valleyviewconstruct.com

myfortniteskins.com

cambecare.com

csec2011.com

idookap.com

warmwallsrecords.com

smartmirror.one

Targets

    • Target

      564508cbfae2c08aec669e47219f9b00

    • Size

      626KB

    • MD5

      564508cbfae2c08aec669e47219f9b00

    • SHA1

      36f867db04e9f8a9c9b585df26ba1f4391a0ccbf

    • SHA256

      f27c4430f40881602df511b48cd0704e0c4050a0ef1d8f0b920f8b7d0da77b96

    • SHA512

      c35b9bc7a6662d52d570a9fcf6f825603d72471375f25598d1dd0112312c729cca0fb3089bedbb84678215e8f8a4c9770af3933aa40133edd90957e8ba36c7b4

    • SSDEEP

      12288:buAfiG2zVQxaZ9NE+g3pTCrIq6J+5SvYvXIo+CHz1FZzPyimdcEp:6AatzGUcuMCb

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks