General
-
Target
548fdfece95e8429e3cb9bf046263413b8cb15766af0ed52f7400f69ffd056ea
-
Size
448KB
-
Sample
241121-y2pfaa1mbq
-
MD5
d7a4b38e86a8228d35f18811fd501678
-
SHA1
691082b2d9373244de86244fd29634e1c74f5c43
-
SHA256
548fdfece95e8429e3cb9bf046263413b8cb15766af0ed52f7400f69ffd056ea
-
SHA512
e580946753afc6a79b29e32e13e6e6b88b7d2c26e0824c820cad91a5c8d7ff062550094e66344d3bf7aae181f38552a4b4ac8484a4ce084d0b16d6be5422bf3c
-
SSDEEP
12288:N0Rx4B3x+gEgm3QUZgWvgBe4b1qfdWkTf1T2T:NyUMAegWvgAjWkT92T
Malware Config
Extracted
xloader
2.5
6f3o
mathoussecleaningservices.com
yogirajhousekeeping.com
abigbowlofcorn.com
jasonkerkmans.com
drugbar.biz
ofilmyzillz.agency
453821.com
reginamaiden.com
bearingsloirb.xyz
trc-bilibao.com
yiyo-group.com
johnkhamilton.store
siliconpklfjl.xyz
edimacare.com
littlerebelmanagement.com
mailheld.digital
nexteventtnpasumo5.xyz
arabatalmustahlik.com
423674.com
orwickeu.com
Targets
-
-
Target
42aa0f6f52d1280d1b150376031a9c93a319771b478dbcf69c540cabfc7a7336
-
Size
624KB
-
MD5
d99953eb7bdc48ba8a60718a99e8b545
-
SHA1
8d1524f9866ef71dd0e95bbaab8ec37d9b5e71cc
-
SHA256
42aa0f6f52d1280d1b150376031a9c93a319771b478dbcf69c540cabfc7a7336
-
SHA512
58ffa96e531bcdbb9b2f29d4a018df2b82a124cde0aa5b40b8e8f584b109ea4c44581c264ef3051fbe0bf3f6ae86645f48d9be1767e8835fee7269cbcb717e90
-
SSDEEP
12288:/JHHgmUCW70uXwFGMxlviBL5p/UgTF3y8pJr9L9mRMu:xngmUJ4ugFBiLp/U+CgJZLkM
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
Xloader payload
-
Suspicious use of SetThreadContext
-