General
-
Target
9ef41663fda8e15739cfe94a66fad59e
-
Size
752KB
-
Sample
231227-dg1ycsccdr
-
MD5
9ef41663fda8e15739cfe94a66fad59e
-
SHA1
1a0cd2daa8a407ac38f130e629fd83f37f41c4cb
-
SHA256
bb9e87b2006433c6f980b323396bbe97cfb4ff1d64f1f03308a0a610a566b628
-
SHA512
4170dd04c14e31b99b1229b29f2feb49e2afae3fed85c8b409e458483ab93d259379dd43f5195bee9ccf034d9ddf8c3fe48212c3f4de24154bde07b00e2e40d2
-
SSDEEP
12288:aVRedoiPjXROr+bPpJobM1hneVBfZlwm9zzfRdim6WmZbE7Q:4edfPjX8+bwbeejRlDhzbim/mlAQ
Malware Config
Extracted
xloader
2.3
ipa8
royalposhpups.com
univa.world
lanerbo.com
shopbabygo.com
theutahhomestore.com
serialmixer.icu
linfeiya.com
xn--12cg3de5c2eb5cyi.com
am-conseil-communication.com
dailygame168.com
therightmilitia.com
visions-agency.com
mapopi.com
frugallyketo.com
guapandglo.com
54w-x126v.net
your-health-kick.com
blockchainhub360.com
registernowhd.xyz
votekellykitashima.com
Targets
-
-
Target
STSGN5512604-pdf..exe
-
Size
1.6MB
-
MD5
73f4257033c590c868506ed0a0aa7a29
-
SHA1
bf288989eec6aa6a6f4bb2696d189d08d268e0db
-
SHA256
cbe7c0318d2f88aff2f18fc19a824bfdebcf2f7137d85adac1a5799afbb6876b
-
SHA512
27021063a83959f39d7f4138055fff4910fe692e97d86f0f5c7259d5013ebbc7e9025b84f9418225df98aee5da54a0abf0446c30487b2b5c6107c9eb2b562392
-
SSDEEP
24576:/IcLW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+hul:wLiecj1a/TEuNQuiNB/e
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-