General
-
Target
209fbc8b761824af543aa3085b0f1bc4
-
Size
700KB
-
Sample
231230-3vn86aacc7
-
MD5
209fbc8b761824af543aa3085b0f1bc4
-
SHA1
07a13c0be9613f6ad0c4914a66e466394a56638a
-
SHA256
40872d476cb128d49b27f28680b5154cd9f3bf786b57cff13d627f35a2ee3701
-
SHA512
4369ed458bbbfbefe5b4b294479672ab7dc5282866938477adfa6ccb73ac417822582d318c3fce7c627f817972b28bfd13ca9ea88dc0e8fd5fe80496aacbf1bb
-
SSDEEP
6144:/KLqdhTQ1AHUk9vwDQ6HncvEEupZoJosGtOKf:S2L8i0kU1pZJVf
Malware Config
Extracted
xloader
2.3
adn9
suffrage19.com
desmareesmontantes.net
polishchuk-myroslava.com
compro-online.com
leadenhallstreettrustees.com
beixiyb.com
startlite.net
thewavelengthco.com
shop-sign-drive.com
angeliquestidhum.com
kaanins.com
reversemortgageloantexas.com
alveolo.net
everythingwholesalers.com
islacros.digital
bainrix.com
brittanyinbloom.com
zfezx08.com
yongqingfanhuali.com
gypsyjewelint.com
Targets
-
-
Target
209fbc8b761824af543aa3085b0f1bc4
-
Size
700KB
-
MD5
209fbc8b761824af543aa3085b0f1bc4
-
SHA1
07a13c0be9613f6ad0c4914a66e466394a56638a
-
SHA256
40872d476cb128d49b27f28680b5154cd9f3bf786b57cff13d627f35a2ee3701
-
SHA512
4369ed458bbbfbefe5b4b294479672ab7dc5282866938477adfa6ccb73ac417822582d318c3fce7c627f817972b28bfd13ca9ea88dc0e8fd5fe80496aacbf1bb
-
SSDEEP
6144:/KLqdhTQ1AHUk9vwDQ6HncvEEupZoJosGtOKf:S2L8i0kU1pZJVf
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-