General
-
Target
3a91f6caa3965066b881d1de7a67f1b9
-
Size
680KB
-
Sample
231231-vfegeaahhn
-
MD5
3a91f6caa3965066b881d1de7a67f1b9
-
SHA1
6097fcf7687e0ec485eae2d57cf9b993ab520375
-
SHA256
3085d62628657edccc65a18edda86f253fb86712a4e50b1cf67828bfa2d33e80
-
SHA512
516b5704221bc49d607b80bafd6841976019f908869449c97f6a27c2840d43f62c76af2c5e464fb6b3f04079045b95883d3ed7fd684be1a269ec1663ba2b2dfb
-
SSDEEP
6144:SDnzTkV5gplawjJlNbno7QCGyfVENB+r5XmLXGZEKr042gBHL3Q9I5Oup:4nxawjlnAVfVIBc5XmL2O42gBHDQ9WN
Malware Config
Extracted
xloader
2.3
k8b5
sardamedicals.com
reelectkendavis4council.com
coreconsultation.com
fajarazhary.com
mybitearner.com
brightpet.info
voicewithchoice.com
bailbondscompany.xyz
7133333333.com
delights.info
gawlvegdr.icu
sdqhpm.com
we2savvyok.com
primallifeathlete.com
gdsinglecell.com
isokineticmachines.com
smartneckrelax.com
gardenvintage.com
hiphopvolume.com
medicapoint.com
Targets
-
-
Target
3a91f6caa3965066b881d1de7a67f1b9
-
Size
680KB
-
MD5
3a91f6caa3965066b881d1de7a67f1b9
-
SHA1
6097fcf7687e0ec485eae2d57cf9b993ab520375
-
SHA256
3085d62628657edccc65a18edda86f253fb86712a4e50b1cf67828bfa2d33e80
-
SHA512
516b5704221bc49d607b80bafd6841976019f908869449c97f6a27c2840d43f62c76af2c5e464fb6b3f04079045b95883d3ed7fd684be1a269ec1663ba2b2dfb
-
SSDEEP
6144:SDnzTkV5gplawjJlNbno7QCGyfVENB+r5XmLXGZEKr042gBHL3Q9I5Oup:4nxawjlnAVfVIBc5XmL2O42gBHDQ9WN
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-