General
-
Target
50bf3a1537a18860a50d76f8bf5c361bbfb4615ab42b84bda9538717ba74d6d1
-
Size
562KB
-
Sample
241121-y84hsaxkay
-
MD5
11323ecd2786542c6e652aeb318e9ab9
-
SHA1
e93e8e61fcc37320587b68103bf994efb1f511f5
-
SHA256
50bf3a1537a18860a50d76f8bf5c361bbfb4615ab42b84bda9538717ba74d6d1
-
SHA512
a3e8a4434897c7ed4520e4a1bb291c9c2aa5e7d7fb6a45ffbc5020f6be60621ec8e4185fb9c54f703afb6176331ed1411288d4ce8f271568ff2eb0619bd2dc07
-
SSDEEP
12288:I0E3mhu3v9oibrEjtXXqx3TQ85ets6Q37Zra/u9KWPJ7Con:Idmu3uwEhHqxTQ8WM3F+IKWJuE
Malware Config
Extracted
xloader
2.3
ojmi
kamdhenugreens.com
lunairlifetsyle.com
dawahmotivation.com
trangsangtunhien.com
lunarrosecrafts.com
metrobyte-mobil.com
clanpms.com
sreeprayagtravels.com
37sdsd.com
asimcompany.com
jiachangcai100.com
easternmktg.com
baolixi.net
huameiai.com
glossyskinco.com
signupforhuntington.com
flatner.com
jadi.express
westinsiraybay-th.com
robsoncabral.com
Targets
-
-
Target
968e6728a9e909dbcce429b21731f83a.exe
-
Size
574KB
-
MD5
968e6728a9e909dbcce429b21731f83a
-
SHA1
231a29a43cbb83bf714634efdcfc6076f820bcc2
-
SHA256
9589e2ffa7b1e7adb7b29587e34acc76b49e4613c6ef7297447dd7a0c9cb4183
-
SHA512
62969b3ecee6eff2c80963f3c1ee43d1e4ae7f9af171bd48a5b0fe0e1fd7567f7f449916226c205a14b091fb81758bd18fc573fbfc87174a84056e2d8df7c18b
-
SSDEEP
12288:VXe9PPlowWX0t6mOQwg1Qd15CcYk0We1YR2P1b2U48+woOO:chloDX0XOf4/YUbhLO
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
Xloader payload
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-