General
-
Target
8a76c158c4755f2c88c08a983ff96473
-
Size
692KB
-
Sample
231226-ypz19ahhdp
-
MD5
8a76c158c4755f2c88c08a983ff96473
-
SHA1
35f2fa98f04dafb50967c03d1f6b87c1ee1134e4
-
SHA256
1cf1f7f61bb2fcdf5746b58681b0050e68076268cd08c1419ec869117ec7fcbb
-
SHA512
273eeda207b4e3fdf093e74bb0088c931b813731294dcfc9a16eceb8a8a894cd3bc3ce9a4a4aac04ce3af4da0e747397f3091deb6d81cb8c8e42bb7334e42090
-
SSDEEP
12288:/3bPU9vPU96Dm+s/IoOOsBgo0q4wMpLIUx0WytghL34yzHdtmwbp8P5i0:/3uoOOsBgo0q4wM6Wyt+oyzHdtmwbpUb
Malware Config
Extracted
xloader
2.3
ipa8
royalposhpups.com
univa.world
lanerbo.com
shopbabygo.com
theutahhomestore.com
serialmixer.icu
linfeiya.com
xn--12cg3de5c2eb5cyi.com
am-conseil-communication.com
dailygame168.com
therightmilitia.com
visions-agency.com
mapopi.com
frugallyketo.com
guapandglo.com
54w-x126v.net
your-health-kick.com
blockchainhub360.com
registernowhd.xyz
votekellykitashima.com
Targets
-
-
Target
8a76c158c4755f2c88c08a983ff96473
-
Size
692KB
-
MD5
8a76c158c4755f2c88c08a983ff96473
-
SHA1
35f2fa98f04dafb50967c03d1f6b87c1ee1134e4
-
SHA256
1cf1f7f61bb2fcdf5746b58681b0050e68076268cd08c1419ec869117ec7fcbb
-
SHA512
273eeda207b4e3fdf093e74bb0088c931b813731294dcfc9a16eceb8a8a894cd3bc3ce9a4a4aac04ce3af4da0e747397f3091deb6d81cb8c8e42bb7334e42090
-
SSDEEP
12288:/3bPU9vPU96Dm+s/IoOOsBgo0q4wMpLIUx0WytghL34yzHdtmwbp8P5i0:/3uoOOsBgo0q4wM6Wyt+oyzHdtmwbpUb
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Xloader payload
-
Suspicious use of SetThreadContext
-