General
-
Target
c1ab0cd682c0c413e3a97367a956c4df.bin
-
Size
788KB
-
Sample
240313-c4xc1scf43
-
MD5
c1ab0cd682c0c413e3a97367a956c4df
-
SHA1
42e55a771d90cde1ab5b43e95a567dc6a838e791
-
SHA256
f288b16da5d90835bd0d44ea4abf3a81d249c3470997edca80a61fcb5866a526
-
SHA512
8c125f0c63435af7a99f70afecd9a391ac3bb91be58b58f6fc503fbdfc2d72707679ce808f1d85c73bbb508a6212f597f7708b7383f5efca3018c9d925ab5994
-
SSDEEP
12288:Xe4mNPh8Hr4XpFym6jT0SU/VqBckWjQjb7mDuDDn2iN:Xehhs4XpomqTlqVChbr/1
Malware Config
Extracted
xloader
2.3
b8eu
ppslide.com
savorysinsation.com
camilaediego2021.com
rstrunk.net
xianshikanxiyang.club
1borefruit.com
ay-danil.club
xamangxcoax.club
waltonunderwood.com
laurabissell.com
laurawmorrow.com
albamauto.net
usamlb.com
theoyays.com
freeitproject.com
jijiservice.com
ukcarpetclean.com
wc399.com
xn--pskrtmebeton-dlbc.online
exclusivemerchantsolutions.com
Targets
-
-
Target
c1ab0cd682c0c413e3a97367a956c4df.bin
-
Size
788KB
-
MD5
c1ab0cd682c0c413e3a97367a956c4df
-
SHA1
42e55a771d90cde1ab5b43e95a567dc6a838e791
-
SHA256
f288b16da5d90835bd0d44ea4abf3a81d249c3470997edca80a61fcb5866a526
-
SHA512
8c125f0c63435af7a99f70afecd9a391ac3bb91be58b58f6fc503fbdfc2d72707679ce808f1d85c73bbb508a6212f597f7708b7383f5efca3018c9d925ab5994
-
SSDEEP
12288:Xe4mNPh8Hr4XpFym6jT0SU/VqBckWjQjb7mDuDDn2iN:Xehhs4XpomqTlqVChbr/1
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-