General
-
Target
73a3ea879432d4dde94f127853025919
-
Size
684KB
-
Sample
240125-d8z55sfhak
-
MD5
73a3ea879432d4dde94f127853025919
-
SHA1
354a543f9ec40cbf8dc62847da905b0b22ad804f
-
SHA256
112816e3c681b862208badf3069a7108fb356effaeab80d0235b613e653d9da5
-
SHA512
67e2f54e370d7d9e21a366cf6082ae736a564a3c419a3883cc8671cea003839a5f0f8bb7def3ee6297d15efbbd8556b04d50569e6a9a954b6694e63e11408fcb
-
SSDEEP
6144:9MKbAGKiluRIiLDz4ZozhdJ00Q3etW/RxvNVMQVMVRZJRElpYXwptyKbS1GR2eJ8:DbuRGZoq0Q3mKRZSVkzYXcS1GR2e
Malware Config
Extracted
xloader
2.3
n58i
nl-cafe.com
votetedjaleta.com
britrobertsrealtor.com
globipark.com
citysucces.com
verisignwebsite-verified.com
riddlepc.com
rosecityclimbing.com
oleandrinextract.com
salmankonstruksi.com
needhamchannel.com
refreshx2z.com
youth66.com
pla-russia.com
halloweenmaskpro.com
exdysis.com
1gcz.com
lookgoodman.com
rlxagva.com
stlcityc.com
Targets
-
-
Target
73a3ea879432d4dde94f127853025919
-
Size
684KB
-
MD5
73a3ea879432d4dde94f127853025919
-
SHA1
354a543f9ec40cbf8dc62847da905b0b22ad804f
-
SHA256
112816e3c681b862208badf3069a7108fb356effaeab80d0235b613e653d9da5
-
SHA512
67e2f54e370d7d9e21a366cf6082ae736a564a3c419a3883cc8671cea003839a5f0f8bb7def3ee6297d15efbbd8556b04d50569e6a9a954b6694e63e11408fcb
-
SSDEEP
6144:9MKbAGKiluRIiLDz4ZozhdJ00Q3etW/RxvNVMQVMVRZJRElpYXwptyKbS1GR2eJ8:DbuRGZoq0Q3mKRZSVkzYXcS1GR2e
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-