General
-
Target
495a3851285b29a43693cf5a93516608
-
Size
1.2MB
-
Sample
240107-swlvbahgar
-
MD5
495a3851285b29a43693cf5a93516608
-
SHA1
7ef194179534a1d0a1a7aa4aacd504c0f6e05853
-
SHA256
d4dbb398a31310583837a0e3152c739f965ecf44c01e0aacd0249a85630d88be
-
SHA512
2e7f7849d731f69007f5b80a71b6981c88b110a086ef655b556f59b9f2cc892c453c9b921dc7d9c6646c191737f222c88d5060e0d9d160f57ef1c9f5bbdbd9c3
-
SSDEEP
24576:xDS/d3BKzksPks2y8jeLELZ7UuyvA1MN7ZNZZ:AKquLEF7UzvbN7ZNZ
Malware Config
Extracted
xloader
2.3
wufn
rsautoluxe.com
theroseofsharonsalon.com
singnema.com
nathanielwhite108.com
theforumonline.com
iqpt.info
joneshondaservice.com
fafene.com
solanohomebuyerclass.com
zwq.xyz
searchlakeconroehomes.com
briative.com
frystmor.city
systemofyouth.com
sctsmney.com
tv-safetrading.com
thesweetboy.com
occulusblu.com
pawsthemomentpetphotography.com
travelstipsguide.com
Targets
-
-
Target
495a3851285b29a43693cf5a93516608
-
Size
1.2MB
-
MD5
495a3851285b29a43693cf5a93516608
-
SHA1
7ef194179534a1d0a1a7aa4aacd504c0f6e05853
-
SHA256
d4dbb398a31310583837a0e3152c739f965ecf44c01e0aacd0249a85630d88be
-
SHA512
2e7f7849d731f69007f5b80a71b6981c88b110a086ef655b556f59b9f2cc892c453c9b921dc7d9c6646c191737f222c88d5060e0d9d160f57ef1c9f5bbdbd9c3
-
SSDEEP
24576:xDS/d3BKzksPks2y8jeLELZ7UuyvA1MN7ZNZZ:AKquLEF7UzvbN7ZNZ
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Xloader payload
-
Suspicious use of SetThreadContext
-