General
-
Target
4e94c920ca52e2f3447f935648149376
-
Size
1.1MB
-
Sample
240109-r5te3seaa3
-
MD5
4e94c920ca52e2f3447f935648149376
-
SHA1
d32f87c1bb9fdafc30c9e15bf8633d2379506eb8
-
SHA256
47e5619a856e90342ba0b34fb9f27ebd2bcf10b99b31f93aaabd819699922628
-
SHA512
eb5b9e05f7b94db6ca56b039067eed71f79091550223f78f841fc0dd67c07ddad1091336e29a0f5b026259056e04eae16eeae990361ec5c7da2ba5a6bfe1d811
-
SSDEEP
24576:Vb60Wjs89CoS8HNzSwmdQfXJPbCSNVcrmMnfk/iQ2+S0d1Iepz0Zm:dWjsa/S23mdyHi9fk/PjBz/
Malware Config
Extracted
xloader
2.3
n58i
nl-cafe.com
votetedjaleta.com
britrobertsrealtor.com
globipark.com
citysucces.com
verisignwebsite-verified.com
riddlepc.com
rosecityclimbing.com
oleandrinextract.com
salmankonstruksi.com
needhamchannel.com
refreshx2z.com
youth66.com
pla-russia.com
halloweenmaskpro.com
exdysis.com
1gcz.com
lookgoodman.com
rlxagva.com
stlcityc.com
Targets
-
-
Target
4e94c920ca52e2f3447f935648149376
-
Size
1.1MB
-
MD5
4e94c920ca52e2f3447f935648149376
-
SHA1
d32f87c1bb9fdafc30c9e15bf8633d2379506eb8
-
SHA256
47e5619a856e90342ba0b34fb9f27ebd2bcf10b99b31f93aaabd819699922628
-
SHA512
eb5b9e05f7b94db6ca56b039067eed71f79091550223f78f841fc0dd67c07ddad1091336e29a0f5b026259056e04eae16eeae990361ec5c7da2ba5a6bfe1d811
-
SSDEEP
24576:Vb60Wjs89CoS8HNzSwmdQfXJPbCSNVcrmMnfk/iQ2+S0d1Iepz0Zm:dWjsa/S23mdyHi9fk/PjBz/
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-