General
-
Target
b42d518aa582754ad176a802dfcebf6a9720e6f10a5484458b64a1bcbccf59e1
-
Size
471KB
-
Sample
240904-vqha2stfln
-
MD5
edf4ad39f63b58952197d4c63aa2669e
-
SHA1
cbd4bf2b32ac5ebd1e8d3d69927045552070b54f
-
SHA256
b42d518aa582754ad176a802dfcebf6a9720e6f10a5484458b64a1bcbccf59e1
-
SHA512
9f2fa8d2ca96933cb9fe2f7c958ec186915664bdafe7bbf9a8cfb87564d33cbf9716cd86ebb74ef67a48c32dbcb866611cd48086795065ce28f8c88fb7580f19
-
SSDEEP
12288:AO25XgLxAfTPd6CQMIo/5qm63AnYzDI6y:C+xqTF6CxIw5b6PM
Malware Config
Extracted
xloader
2.5
fqiq
driventow.com
ipatchwork.today
bolder.equipment
seal-brother.com
mountlaketerraceapartments.com
weeden.xyz
sanlifalan.com
athafood.com
isshinn1.com
creationslazzaroni.com
eclecticrenaissancewoman.com
satellitephonstore.com
cotchildcare.com
yamacorp.digital
ff4cuno43.xyz
quicksticks.community
govindfinance.com
farmersfirstseed.com
megacinema.club
tablescaperendezvous4two.com
Targets
-
-
Target
f285919ddd1e956b6bcb0572ab1eeca5553617ee8e84f5afe564f63e3d8477cb
-
Size
585KB
-
MD5
e697597160d3446c70406d8089ad9422
-
SHA1
0c3af2a2b19b935a24a1ef33cb0ed454f6225cbc
-
SHA256
f285919ddd1e956b6bcb0572ab1eeca5553617ee8e84f5afe564f63e3d8477cb
-
SHA512
9ad0d6a39001724998211951f9f8ab757fd0fd599bf55f3cba9f560e913fc64c7f0c299c7dc65284f833ad6211cdb6019c7dc5aa464e21e48bb703044e582a9c
-
SSDEEP
12288:ny3bU4N/HJRNwwC6dQ7HG+4FnjLlOhsxeHHb:0fJrPZQ7HGhBpOyxenb
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-