General
-
Target
73f4257033c590c868506ed0a0aa7a29
-
Size
1.6MB
-
Sample
240125-g3v6saadgp
-
MD5
73f4257033c590c868506ed0a0aa7a29
-
SHA1
bf288989eec6aa6a6f4bb2696d189d08d268e0db
-
SHA256
cbe7c0318d2f88aff2f18fc19a824bfdebcf2f7137d85adac1a5799afbb6876b
-
SHA512
27021063a83959f39d7f4138055fff4910fe692e97d86f0f5c7259d5013ebbc7e9025b84f9418225df98aee5da54a0abf0446c30487b2b5c6107c9eb2b562392
-
SSDEEP
24576:/IcLW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+hul:wLiecj1a/TEuNQuiNB/e
Malware Config
Extracted
xloader
2.3
ipa8
royalposhpups.com
univa.world
lanerbo.com
shopbabygo.com
theutahhomestore.com
serialmixer.icu
linfeiya.com
xn--12cg3de5c2eb5cyi.com
am-conseil-communication.com
dailygame168.com
therightmilitia.com
visions-agency.com
mapopi.com
frugallyketo.com
guapandglo.com
54w-x126v.net
your-health-kick.com
blockchainhub360.com
registernowhd.xyz
votekellykitashima.com
Targets
-
-
Target
73f4257033c590c868506ed0a0aa7a29
-
Size
1.6MB
-
MD5
73f4257033c590c868506ed0a0aa7a29
-
SHA1
bf288989eec6aa6a6f4bb2696d189d08d268e0db
-
SHA256
cbe7c0318d2f88aff2f18fc19a824bfdebcf2f7137d85adac1a5799afbb6876b
-
SHA512
27021063a83959f39d7f4138055fff4910fe692e97d86f0f5c7259d5013ebbc7e9025b84f9418225df98aee5da54a0abf0446c30487b2b5c6107c9eb2b562392
-
SSDEEP
24576:/IcLW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+hul:wLiecj1a/TEuNQuiNB/e
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-