General
- Target f6da8480cbbc1d09ddcc010aa3c5c52f9dbc8a32cf0947f1ccc3df6165a70c57
- Size 329KB
- Sample240902-bbpxssxgnc
- SHA256 f6da8480cbbc1d09ddcc010aa3c5c52f9dbc8a32cf0947f1ccc3df6165a70c57
Score
10/10
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
ef6c
Decoy
-
gicaredocs.com
-
govusergroup.com
-
conversationspit.com
-
brondairy.com
-
rjtherealest.com
-
xn--9m1bq8wgkag3rjvb.com
-
mylori.net
-
softandcute.store
-
ahljsm.com
-
shacksolid.com
-
weekendmusecollection.com
-
gaminghallarna.net
-
pgonline111.online
-
44mpt.xyz
-
ambrandt.com
-
eddytattoo.com
-
blendeqes.com
-
upinmyfeels.com
-
lacucinadesign.com
-
docomoau.xyz
Targets
-
- Target 49a344e5002bb1b35a0a5db1c82358c43de798acfd0192a88dc11245de163bd8
- Size 388KB
- SHA256 49a344e5002bb1b35a0a5db1c82358c43de798acfd0192a88dc11245de163bd8
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext