General
-
Target
02c88eb05467059be1c00d845522bce2
-
Size
1.3MB
-
Sample
231229-y12dfsadcr
-
MD5
02c88eb05467059be1c00d845522bce2
-
SHA1
6d86a993f5b2105035d3f4cd7143641b5c94fe85
-
SHA256
4be74c7ec708983ac0360cbdae0a793aac71e2d3215d808dbb1cfb5d2c771e93
-
SHA512
6624a69da556bd03ba5a4eebd225c787d937be18d4d4788e92750d673013e6cb819c4b5db7590a832263566b67d0d86ac5474a7fdca48f8f884fb6e29f362669
-
SSDEEP
24576:VT4S/d3pYdkh+b5TNiN1Iae37cqQF4T/9bc2mwRGPoN7vdiTbnFM:UbHMIaeYqQWRhm/PoiM
Malware Config
Extracted
xloader
2.3
p086
jinshichain.com
worldpettraveler.com
hightecforpc.com
kj97fm.com
streetnewstv.com
webrew.club
wheretogodubai.com
apostapolitica.net
thecafy.com
vinelosangeles.com
gashinc.com
gutitout.net
bvd-invest.com
realtoroutdesk.com
lawnbowlstournaments.net
nobodyisillegal.com
abogadoorihuela.net
sanistela.com
jksecurityworld.com
peppermintproject.com
Targets
-
-
Target
02c88eb05467059be1c00d845522bce2
-
Size
1.3MB
-
MD5
02c88eb05467059be1c00d845522bce2
-
SHA1
6d86a993f5b2105035d3f4cd7143641b5c94fe85
-
SHA256
4be74c7ec708983ac0360cbdae0a793aac71e2d3215d808dbb1cfb5d2c771e93
-
SHA512
6624a69da556bd03ba5a4eebd225c787d937be18d4d4788e92750d673013e6cb819c4b5db7590a832263566b67d0d86ac5474a7fdca48f8f884fb6e29f362669
-
SSDEEP
24576:VT4S/d3pYdkh+b5TNiN1Iae37cqQF4T/9bc2mwRGPoN7vdiTbnFM:UbHMIaeYqQWRhm/PoiM
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Xloader payload
-
Suspicious use of SetThreadContext
-