General
-
Target
13f7ac3ff9f20fbf5e94647a7654c81f
-
Size
634KB
-
Sample
231230-kyh77sebdm
-
MD5
13f7ac3ff9f20fbf5e94647a7654c81f
-
SHA1
62b5e8836bd598ba23d18208ac11ceef682d5286
-
SHA256
eddb900c9e73f050ce4a90866c3923abf4bee473aedd23b2ac603868cd88f311
-
SHA512
e7077a47f12118db94befac49e90eaf5f1c2b1e9e65d4694d97dab90235dd51a909d4d169ecf2cef5806a6abf2b1f52109318d28e16effa9aa14d77ce38b66b5
-
SSDEEP
12288:VBXE7lO5Nxa7s3AxIlJd8HDnRnWlqeOLMkohasnbfX/C690/BwrQmFeJxpZZLrOa:VBXm05H0ejPuHDRojLph7V90JoQYepLF
Malware Config
Extracted
xloader
2.3
ipa8
royalposhpups.com
univa.world
lanerbo.com
shopbabygo.com
theutahhomestore.com
serialmixer.icu
linfeiya.com
xn--12cg3de5c2eb5cyi.com
am-conseil-communication.com
dailygame168.com
therightmilitia.com
visions-agency.com
mapopi.com
frugallyketo.com
guapandglo.com
54w-x126v.net
your-health-kick.com
blockchainhub360.com
registernowhd.xyz
votekellykitashima.com
Targets
-
-
Target
Stamped Agreement.exe
-
Size
1.0MB
-
MD5
d4ea38bc35cb738b29f73e6750923a95
-
SHA1
8a4d5b7fa21b73f189b82565e3748368148b6a26
-
SHA256
3edf6811850efc722b39737bf3623a42127e728f0c32a0a6ab7c66044838d307
-
SHA512
b72774638a4dd856220117dc9f29bacf0166db6519ecd1f023a446829d403715d6b4a2d8bbb9783b32e412376194e63368a300d1ac326e440c40d9ff6128d958
-
SSDEEP
12288:xVo8KtS2iNQ3HIKYl/jNCr65sT9BE0U7EA/CU1McIJca:oS1sYlZ5sT920w91M3
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-