General
-
Target
cd487ac4410fcfff956806ec61a33de3
-
Size
495KB
-
Sample
240316-gmya7sdc6t
-
MD5
cd487ac4410fcfff956806ec61a33de3
-
SHA1
b07ae144754d79fc09b4960a250c811b1c90dd5c
-
SHA256
db6988403e9bf2b750a78237f65394acafdd31173f013bbb789156d76c4d5eab
-
SHA512
956057023bf10477d6d3bb042d3edd1e4dd636ada7a6b07366cbffcf21d7895bcccb3a3cd72e40b07204ce52dc61c9c27bfda78c9f6cc8e76deb5b8873c2ae86
-
SSDEEP
12288:3cnbLCC0s1e1H6aPHWobMxX+bzwvSH1wkM4ThHhWdv4EM/XNdAbqMC8hv:MnbGN59/MIvp1yx4EKXnV7i
Malware Config
Extracted
xloader
2.3
n58i
nl-cafe.com
votetedjaleta.com
britrobertsrealtor.com
globipark.com
citysucces.com
verisignwebsite-verified.com
riddlepc.com
rosecityclimbing.com
oleandrinextract.com
salmankonstruksi.com
needhamchannel.com
refreshx2z.com
youth66.com
pla-russia.com
halloweenmaskpro.com
exdysis.com
1gcz.com
lookgoodman.com
rlxagva.com
stlcityc.com
Targets
-
-
Target
cd487ac4410fcfff956806ec61a33de3
-
Size
495KB
-
MD5
cd487ac4410fcfff956806ec61a33de3
-
SHA1
b07ae144754d79fc09b4960a250c811b1c90dd5c
-
SHA256
db6988403e9bf2b750a78237f65394acafdd31173f013bbb789156d76c4d5eab
-
SHA512
956057023bf10477d6d3bb042d3edd1e4dd636ada7a6b07366cbffcf21d7895bcccb3a3cd72e40b07204ce52dc61c9c27bfda78c9f6cc8e76deb5b8873c2ae86
-
SSDEEP
12288:3cnbLCC0s1e1H6aPHWobMxX+bzwvSH1wkM4ThHhWdv4EM/XNdAbqMC8hv:MnbGN59/MIvp1yx4EKXnV7i
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-