General
-
Target
0d7b87adc5aae18d3e3984776c32c55c
-
Size
1.3MB
-
Sample
231230-eedkqahgh7
-
MD5
0d7b87adc5aae18d3e3984776c32c55c
-
SHA1
e58f33d4635ddb456c03cbef8904c3afabd32413
-
SHA256
3de22b3c8cc29dccb67b6e985c740057d7883fe98d0f739de0b84c126e1d563a
-
SHA512
85dec75c8ef3b6a8accd35e6139872aeeb511b3a503bb7004769f4d636da66331c93ef9d9938b829140b50ef563acde8e5b6653e1a6648e435163e96a702b8fd
-
SSDEEP
24576:7pwgjKZ/YMAfVqqg/ToMNDMTncW58pEZMD0Lcd+v/Mv2sT:7VjCjAY9o6DMTP5bO0Qkn828
Malware Config
Extracted
xloader
2.3
mabs
joiderqm.com
hyc306.com
ouchplus.asia
abrosnm3.com
hospitalanti-infectives.com
ala-co.com
morrisonltts.net
tradingimpulse.com
invisibleimagination.com
jdjshop.com
huntedby.com
szsgfdzx.com
germfightersusaiowa.com
pahaadpost.com
obrankers.com
plaeralum.com
getfitwithmeministry.com
smartswaploan.com
gypsyjewelrydesigns.com
meetgoodwill.info
Targets
-
-
Target
0d7b87adc5aae18d3e3984776c32c55c
-
Size
1.3MB
-
MD5
0d7b87adc5aae18d3e3984776c32c55c
-
SHA1
e58f33d4635ddb456c03cbef8904c3afabd32413
-
SHA256
3de22b3c8cc29dccb67b6e985c740057d7883fe98d0f739de0b84c126e1d563a
-
SHA512
85dec75c8ef3b6a8accd35e6139872aeeb511b3a503bb7004769f4d636da66331c93ef9d9938b829140b50ef563acde8e5b6653e1a6648e435163e96a702b8fd
-
SSDEEP
24576:7pwgjKZ/YMAfVqqg/ToMNDMTncW58pEZMD0Lcd+v/Mv2sT:7VjCjAY9o6DMTP5bO0Qkn828
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-