General
-
Target
88f306ca63bb704de8cdcdf219be2304906d5fe8b80b569c640b89a73c7608a6
-
Size
468KB
-
Sample
241121-y27xmawqgz
-
MD5
a5a0e5103d680ff91d45f416146d701a
-
SHA1
7a098301dbb45334c61e53795c26f450980e0f4a
-
SHA256
88f306ca63bb704de8cdcdf219be2304906d5fe8b80b569c640b89a73c7608a6
-
SHA512
f3b5b9c6f05cf5acb2e26ad0039ee773d9b2c25c2b490dde0f0c19bc46d2f8190f1051b747a448248829df931ab0be1b20e15ee1342be8b2f4f2bf930a44781a
-
SSDEEP
12288:RNZpcSZH64lga9uD9DQRiA/NjjWDu0kFl8lt5p:nZphX/9Cy/NjqrkFlK5p
Malware Config
Extracted
xloader
2.3
gm9w
steffiemor.com
qe2rvstorage.com
louisteak.com
top-dex2.com
fafeiya.com
saffure.com
1upshopandstuff.com
wemove66.com
deckswap.info
joinjifu.com
joboval.com
stilldeliciousvegan.com
intercunt.com
espaciosterapeutas.com
doglai.com
situationslayer.com
adbreaks.net
cdjy666.com
ap70mm.com
gwh525.xyz
Targets
-
-
Target
732d6097dbd7e3dea8d83a0261e0d834430a56119b278e3fb38b15c27147bf7f.exe
-
Size
585KB
-
MD5
5496ecc8611af1fa119a753fce53cb18
-
SHA1
ad3e75f3f8ce863ea9bd3f5cac9598a7b8a27e82
-
SHA256
732d6097dbd7e3dea8d83a0261e0d834430a56119b278e3fb38b15c27147bf7f
-
SHA512
e1fdffc43c0d903a5aa8c36410d78fadeb24d3baefd8d60fc9dd36aca78d0ada95b2c03ee4b340753ace3b2e925ab3525a75f03b3882bee3683c52ad8a88645e
-
SSDEEP
12288:V1jsAJrnQv6br2GCOovnBvA2J124cnKY1hRg4HRPk6AcHrBZzHr63QC28OB:V1jsU8v6o7vnB42ePbR
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
Xloader payload
-
Suspicious use of SetThreadContext
-