General
-
Target
4fb49002f63c1d6a5819f49f60ff6416
-
Size
763KB
-
Sample
240110-f6fptsfgb4
-
MD5
4fb49002f63c1d6a5819f49f60ff6416
-
SHA1
773640138a9008870dbe1fbc22a273afc185f1a3
-
SHA256
067566cf129aad36652994eb3e80793577108e1308aabe012381ee2f12757fcb
-
SHA512
2091961ee554ada25686337fe160b5b6ed04d771fc812ec0e9f382378ad7e383d46256fd5b6a59130cdecb48887dc2ffd7a5a637aeda60fda8090353acf4f4ea
-
SSDEEP
12288:bflNc8P1Jhcr1r8Xw4LViruk+lp9w/Nsc/MJH9PrH4Ar28wndJxJc68d4m:b/c8P1orh8XwY8uk+/c+H9PLPr28AxKt
Malware Config
Extracted
xloader
2.3
n58i
nl-cafe.com
votetedjaleta.com
britrobertsrealtor.com
globipark.com
citysucces.com
verisignwebsite-verified.com
riddlepc.com
rosecityclimbing.com
oleandrinextract.com
salmankonstruksi.com
needhamchannel.com
refreshx2z.com
youth66.com
pla-russia.com
halloweenmaskpro.com
exdysis.com
1gcz.com
lookgoodman.com
rlxagva.com
stlcityc.com
Targets
-
-
Target
4fb49002f63c1d6a5819f49f60ff6416
-
Size
763KB
-
MD5
4fb49002f63c1d6a5819f49f60ff6416
-
SHA1
773640138a9008870dbe1fbc22a273afc185f1a3
-
SHA256
067566cf129aad36652994eb3e80793577108e1308aabe012381ee2f12757fcb
-
SHA512
2091961ee554ada25686337fe160b5b6ed04d771fc812ec0e9f382378ad7e383d46256fd5b6a59130cdecb48887dc2ffd7a5a637aeda60fda8090353acf4f4ea
-
SSDEEP
12288:bflNc8P1Jhcr1r8Xw4LViruk+lp9w/Nsc/MJH9PrH4Ar28wndJxJc68d4m:b/c8P1orh8XwY8uk+/c+H9PLPr28AxKt
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-