General
-
Target
ff4102bf366374a4e40b5ed903b35e3f2415b5653a3b5407b2993bad1061c957
-
Size
554KB
-
Sample
241121-2ft1essrhk
-
MD5
88ed9bd76c62e6076b724c62d9a0f1a6
-
SHA1
8ddbe99020df5b851bd82eaf9bb81890aa07f419
-
SHA256
ff4102bf366374a4e40b5ed903b35e3f2415b5653a3b5407b2993bad1061c957
-
SHA512
800a4a4d70010b498355ba986c7edfdcf36066f58cfae85d9612f39ed7a350bff608e2cf8f9354b1fa467075075a2c5967419153091e7e8a73e72d7ecd88e42a
-
SSDEEP
12288:oDDqUvdb+FV0+QQzFGUbHpyS5BcBhwObF02eeqbTUTr8Pq3KZ/P:oX3wFuwFvbHp/5BcBxF02eeqbT1SaZX
Malware Config
Extracted
xloader
2.3
oerg
brightly-common.com
petwellness.pet
oldhamluxury.com
cmpembroidery.com
physicalrobot.com
irynazumba.com
testyourself11.com
theblacksportswoman.com
mottestertraining.agency
confrontinghate.info
tamiigun.com
pod14.club
implementnowsolutions.net
letsdance.website
cashforkeysdz.net
grupoprotecsasac.com
kol-lek-tiv.net
funeralhomesmaroail.com
lwfunding.com
junkglobal.com
Targets
-
-
Target
94e7980b5d5669be8b9a317bae7e78c622541fae9091a7874a0f915b93cfd225.bin
-
Size
733KB
-
MD5
f11c988dc002f9bfe2d2e837b7c24e2d
-
SHA1
906a6f6078b9619c93a212071cdc9a6e478d4d1d
-
SHA256
94e7980b5d5669be8b9a317bae7e78c622541fae9091a7874a0f915b93cfd225
-
SHA512
f5a65b3a0e92536ed6916d9b31991fc38262bbcbf722d8c142ce8d79d6f1668f8cc1f7f25dc9e7725837fc3eb10d9b6a22cefbf3658d59fa603e9b1491b9260f
-
SSDEEP
12288:kLC02XeRzd/PpFBd7QZ7zyKPOD53OGGpZsN8VBgJKeBSubj0+WabBQpB0UmKzOap:kLCka0OpaNzKeNjzWUgBjzO
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
Xloader payload
-
Suspicious use of SetThreadContext
-