General
-
Target
e8af1892a757aa0f0693ce9677e69328
-
Size
699KB
-
Sample
231228-tnamradbdr
-
MD5
e8af1892a757aa0f0693ce9677e69328
-
SHA1
f79c8d60ac27830351d257f2dbe00a72ea7b889c
-
SHA256
1ea32ffb0d84a4c157e12e6a3bd153a3cf3bb878ec2ef474fb547ee6fc7e9cc4
-
SHA512
f6f8bf083a5f04c450aa574b803d20eefe5dd1dc423b6ad502a7b7926967f0bd5e79424ce3876018bfb8ef04e0eb801ce6415c3156cccd9c15a5a678bd305ae1
-
SSDEEP
12288:cWVsYVvjsbOyHpBvygTUxi2g8/W9tMyDi0+/FrrsLJ:XUpBvygA8vOaB
Malware Config
Extracted
xloader
2.3
b8eu
ppslide.com
savorysinsation.com
camilaediego2021.com
rstrunk.net
xianshikanxiyang.club
1borefruit.com
ay-danil.club
xamangxcoax.club
waltonunderwood.com
laurabissell.com
laurawmorrow.com
albamauto.net
usamlb.com
theoyays.com
freeitproject.com
jijiservice.com
ukcarpetclean.com
wc399.com
xn--pskrtmebeton-dlbc.online
exclusivemerchantsolutions.com
Targets
-
-
Target
e8af1892a757aa0f0693ce9677e69328
-
Size
699KB
-
MD5
e8af1892a757aa0f0693ce9677e69328
-
SHA1
f79c8d60ac27830351d257f2dbe00a72ea7b889c
-
SHA256
1ea32ffb0d84a4c157e12e6a3bd153a3cf3bb878ec2ef474fb547ee6fc7e9cc4
-
SHA512
f6f8bf083a5f04c450aa574b803d20eefe5dd1dc423b6ad502a7b7926967f0bd5e79424ce3876018bfb8ef04e0eb801ce6415c3156cccd9c15a5a678bd305ae1
-
SSDEEP
12288:cWVsYVvjsbOyHpBvygTUxi2g8/W9tMyDi0+/FrrsLJ:XUpBvygA8vOaB
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Executes dropped EXE
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious use of SetThreadContext
-