General
-
Target
768547393d9e743380e7aaf1cc74879b
-
Size
243KB
-
Sample
240126-f9fh8sfbc4
-
MD5
768547393d9e743380e7aaf1cc74879b
-
SHA1
0788956b1108ee79f49e839f32a6694a2a3f9d33
-
SHA256
75b8ea707e40c7118773f3f2688ab1a18eed690ecded6fe236ec65b4c8be0fd0
-
SHA512
c25ea7b13a52d998b4621e70b8516e9c485ff8caa7dd2f40816f141c189004c638a77a2f8a0dee737e87b98a5976e3c0a68237ed46822c670e750c9a1c256bba
-
SSDEEP
6144:pMXLrlidFFJ20zRnutLXx2sJ8UfEwin6+DFV6bOnui0rHljD1EDg:psL5idLJdnub2jUQ6+xV6bcuDDM8
Malware Config
Extracted
xloader
2.3
pagi
makehrworkable.com
sound-wisdom.com
blacts.com
caenantglamping.com
meridiancpas.com
draughtedinn.co.uk
windywoodshc.com
mintmovileplus.com
pubgeventdailylogin.com
thesocialdzr.com
holapv.com
racevc.com
openpula.pro
wepreventstroke.com
autoclosy.com
enginkarabacak.com
15096eec1652.info
buildthefoundation.net
pwilliamberciklaw.com
paramountrevenueadvisors.com
Targets
-
-
Target
CTM ARRANGEMENT.exe
-
Size
298KB
-
MD5
f5e7bf270b60cd8a71fc8be79ea7aae4
-
SHA1
e9361f22d9b0a2aba641b9cedbaa203ac32e30c6
-
SHA256
88a982fd729f861a4439a59e632a7d76eb033991c437a2368bc2a834873f1f8a
-
SHA512
cea75189109aab37974c7f57b7008c18755e362658ef47cfc093708fbe8b8ef06383458f898ebf11b1359b334980a70d18604a79265176d4773c3dfdfe4ab097
-
SSDEEP
6144:jCeJW1DhGOWLpoLuVLhiade0Huq8PGMZW/d+2t7i+:/WJhGOWLpogLAa40+PGMZHe7l
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-