General
-
Target
1b58203ecd7ef5d31ea39a5218b40115
-
Size
490KB
-
Sample
231230-rrb9msgffp
-
MD5
1b58203ecd7ef5d31ea39a5218b40115
-
SHA1
2770e86784c8e3bc62f59a02c92390bd74b6dc98
-
SHA256
f5e9658f44135be66cc2cb4862c67326c803871e49a73b0376b266cb95c41f52
-
SHA512
1f5e3a616713cf8daa6778ab6a895ed488ac294bf677b967ff68dec9a8fd0a14c679f4e0d79131640566f95f27cbf0bebf9f5291f70b7cd26e405a05b296fe9e
-
SSDEEP
12288:dtfEdMQEJJMkdBvd1Zy8OfGPAE9Zsi4hdStfDWc8Q2tZsi:dtsdoJuEBvd1g5fGPP9Zsf
Malware Config
Extracted
xloader
2.3
k8b5
sardamedicals.com
reelectkendavis4council.com
coreconsultation.com
fajarazhary.com
mybitearner.com
brightpet.info
voicewithchoice.com
bailbondscompany.xyz
7133333333.com
delights.info
gawlvegdr.icu
sdqhpm.com
we2savvyok.com
primallifeathlete.com
gdsinglecell.com
isokineticmachines.com
smartneckrelax.com
gardenvintage.com
hiphopvolume.com
medicapoint.com
Targets
-
-
Target
1b58203ecd7ef5d31ea39a5218b40115
-
Size
490KB
-
MD5
1b58203ecd7ef5d31ea39a5218b40115
-
SHA1
2770e86784c8e3bc62f59a02c92390bd74b6dc98
-
SHA256
f5e9658f44135be66cc2cb4862c67326c803871e49a73b0376b266cb95c41f52
-
SHA512
1f5e3a616713cf8daa6778ab6a895ed488ac294bf677b967ff68dec9a8fd0a14c679f4e0d79131640566f95f27cbf0bebf9f5291f70b7cd26e405a05b296fe9e
-
SSDEEP
12288:dtfEdMQEJJMkdBvd1Zy8OfGPAE9Zsi4hdStfDWc8Q2tZsi:dtsdoJuEBvd1g5fGPP9Zsf
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-