General
-
Target
b2c03f6d3350d1fd1030cacbdbe6afe1
-
Size
634KB
-
Sample
240304-wjm4dsgh8s
-
MD5
b2c03f6d3350d1fd1030cacbdbe6afe1
-
SHA1
5d2bb1c26ce713dd0449538ebc075b82da4a87a9
-
SHA256
651a9c820059a24297d0aa7b4b07af874878dfe672ceb2ff65fe557f46b7f39a
-
SHA512
8fbce01f370a778d5ba93c70db8d70870b28a46744244fcf9f31cea7c83c9632ee19eb5c80632f9b04cc05587ddd7c9995a616c9dcadd44224f31da6d27870e0
-
SSDEEP
12288:/BXE7lO5Nxa7s3AxIlJd8HDnRnWlqeOLMkohasnbfX/C690/BwrQmFeJxpZZLrO1:/BXm05H0ejPuHDRojLph7V90JoQYepLs
Malware Config
Extracted
xloader
2.3
ipa8
royalposhpups.com
univa.world
lanerbo.com
shopbabygo.com
theutahhomestore.com
serialmixer.icu
linfeiya.com
xn--12cg3de5c2eb5cyi.com
am-conseil-communication.com
dailygame168.com
therightmilitia.com
visions-agency.com
mapopi.com
frugallyketo.com
guapandglo.com
54w-x126v.net
your-health-kick.com
blockchainhub360.com
registernowhd.xyz
votekellykitashima.com
Targets
-
-
Target
2F0011-5 Bank slip-pdf.exe
-
Size
1.0MB
-
MD5
d4ea38bc35cb738b29f73e6750923a95
-
SHA1
8a4d5b7fa21b73f189b82565e3748368148b6a26
-
SHA256
3edf6811850efc722b39737bf3623a42127e728f0c32a0a6ab7c66044838d307
-
SHA512
b72774638a4dd856220117dc9f29bacf0166db6519ecd1f023a446829d403715d6b4a2d8bbb9783b32e412376194e63368a300d1ac326e440c40d9ff6128d958
-
SSDEEP
12288:xVo8KtS2iNQ3HIKYl/jNCr65sT9BE0U7EA/CU1McIJca:oS1sYlZ5sT920w91M3
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-