General
-
Target
3b84ddaaa08bab7e83d4afedf7a55805
-
Size
1.3MB
-
Sample
240101-bdv7lahafq
-
MD5
3b84ddaaa08bab7e83d4afedf7a55805
-
SHA1
0f29d04eec95b9797bf56b7ffcb74be064c84068
-
SHA256
574935899092cf394cbec27200bacb9e372d2e9c299d8ed91705d29fe85465c8
-
SHA512
34d41eab2af6e44b0147f62e38fdbeea523cdd77ecc31d032129f8e39f0c1c27e1df422897a8e83a0cbb1989f552a5fd076d89b25623a95b1950451e818c03f5
-
SSDEEP
24576:7Gcb76DOofx8Dgyfx8DgFU1SkuH+T0vGyNr8Hp89dwDZGfL:Vb76x58Dgy58DgFUIK6ri89yZO
Malware Config
Extracted
xloader
2.3
wufn
rsautoluxe.com
theroseofsharonsalon.com
singnema.com
nathanielwhite108.com
theforumonline.com
iqpt.info
joneshondaservice.com
fafene.com
solanohomebuyerclass.com
zwq.xyz
searchlakeconroehomes.com
briative.com
frystmor.city
systemofyouth.com
sctsmney.com
tv-safetrading.com
thesweetboy.com
occulusblu.com
pawsthemomentpetphotography.com
travelstipsguide.com
Targets
-
-
Target
3b84ddaaa08bab7e83d4afedf7a55805
-
Size
1.3MB
-
MD5
3b84ddaaa08bab7e83d4afedf7a55805
-
SHA1
0f29d04eec95b9797bf56b7ffcb74be064c84068
-
SHA256
574935899092cf394cbec27200bacb9e372d2e9c299d8ed91705d29fe85465c8
-
SHA512
34d41eab2af6e44b0147f62e38fdbeea523cdd77ecc31d032129f8e39f0c1c27e1df422897a8e83a0cbb1989f552a5fd076d89b25623a95b1950451e818c03f5
-
SSDEEP
24576:7Gcb76DOofx8Dgyfx8DgFU1SkuH+T0vGyNr8Hp89dwDZGfL:Vb76x58Dgy58DgFUIK6ri89yZO
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-