General
-
Target
9ec36a263e339b95d1c21ab7234372a5
-
Size
1.5MB
-
Sample
240215-2mt9rsbc63
-
MD5
9ec36a263e339b95d1c21ab7234372a5
-
SHA1
29d6d78a8205cc7e7a7e565677fc697f09573d5d
-
SHA256
940ee40d0ea9f6a02abe1f52323341d70a4b5ee4fb8135a1711a45024f927b60
-
SHA512
635a31e716a8078c8f80e299746d806120a7b673cbfce70c665537992e4b2fb38373ae5faf488d1aba92d5438d1d93c2c12f894d46b38ed80aa6384fb41f5776
-
SSDEEP
12288:Pn32WV51OMAEjywW+8ehqmtgfZMYxQouJhYRI8RbCQ6H+Uy1Susr8MmH3jnS:/zz1O0mwRdqmGBMMQZhYRfF/ZZS5R0
Malware Config
Extracted
xloader
2.3
be4o
gosth-kitchen.com
300coin.club
mdseenergys.com
weizhong.asia
pixorum.com
rdchicken.com
beverlyhills-mc.com
voteelliot.com
noithatsongtung.com
bestiepetinsurance.net
pannacottagames.com
materaweddings.com
kryodry.com
hardlikeaboss.com
fnhope.com
blun33.com
rentmystuff.pro
maimaimaoba.com
caneteperu.com
lata-gouveia.com
Targets
-
-
Target
9ec36a263e339b95d1c21ab7234372a5
-
Size
1.5MB
-
MD5
9ec36a263e339b95d1c21ab7234372a5
-
SHA1
29d6d78a8205cc7e7a7e565677fc697f09573d5d
-
SHA256
940ee40d0ea9f6a02abe1f52323341d70a4b5ee4fb8135a1711a45024f927b60
-
SHA512
635a31e716a8078c8f80e299746d806120a7b673cbfce70c665537992e4b2fb38373ae5faf488d1aba92d5438d1d93c2c12f894d46b38ed80aa6384fb41f5776
-
SSDEEP
12288:Pn32WV51OMAEjywW+8ehqmtgfZMYxQouJhYRI8RbCQ6H+Uy1Susr8MmH3jnS:/zz1O0mwRdqmGBMMQZhYRfF/ZZS5R0
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-