General
-
Target
3bb20c65724c4ff9dafcd43ecc3bb19a
-
Size
1.3MB
-
Sample
240101-dbbfhsachj
-
MD5
3bb20c65724c4ff9dafcd43ecc3bb19a
-
SHA1
8f53ab8c1f429a4163b7ff29c00b5a5645d4e99f
-
SHA256
fe91f4c75d949b09bad65f63e87002e536de9ef8b606455e4044901172a7cb8b
-
SHA512
e1274d853691388df0ccf51738bbcb62b6c87a01b742487784f10f8d4316137aa035eb9543489468daad6eb027f25fc5f5229ff42007cd0955d399ccf0ef4543
-
SSDEEP
24576:VT4S/d3pYdkh+b5TNiN1Iae37cqQF4T/9bc2mwRXPoN7vdiTbnFM:UbHMIaeYqQWRhmmPoiM
Malware Config
Extracted
xloader
2.3
p086
jinshichain.com
worldpettraveler.com
hightecforpc.com
kj97fm.com
streetnewstv.com
webrew.club
wheretogodubai.com
apostapolitica.net
thecafy.com
vinelosangeles.com
gashinc.com
gutitout.net
bvd-invest.com
realtoroutdesk.com
lawnbowlstournaments.net
nobodyisillegal.com
abogadoorihuela.net
sanistela.com
jksecurityworld.com
peppermintproject.com
Targets
-
-
Target
3bb20c65724c4ff9dafcd43ecc3bb19a
-
Size
1.3MB
-
MD5
3bb20c65724c4ff9dafcd43ecc3bb19a
-
SHA1
8f53ab8c1f429a4163b7ff29c00b5a5645d4e99f
-
SHA256
fe91f4c75d949b09bad65f63e87002e536de9ef8b606455e4044901172a7cb8b
-
SHA512
e1274d853691388df0ccf51738bbcb62b6c87a01b742487784f10f8d4316137aa035eb9543489468daad6eb027f25fc5f5229ff42007cd0955d399ccf0ef4543
-
SSDEEP
24576:VT4S/d3pYdkh+b5TNiN1Iae37cqQF4T/9bc2mwRXPoN7vdiTbnFM:UbHMIaeYqQWRhmmPoiM
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Xloader payload
-
Suspicious use of SetThreadContext
-