General
-
Target
b10c700778a2e577bc6cab35255362fee5c351fc98bffc2b96394efba5991ce7
-
Size
399KB
-
Sample
241121-y9dczs1qan
-
MD5
7ea94dcf17b421221e6712d1f66aa798
-
SHA1
5eeb6c117c8321436def50de7286aec9c57deda0
-
SHA256
b10c700778a2e577bc6cab35255362fee5c351fc98bffc2b96394efba5991ce7
-
SHA512
a45e671cf9bddaa2e01974ba937a96ef61dbc7556e6c9ea2e71627eb2fd6c8699f4e1e6a49e383eb02e3363440fbd2bac0627bdddda1a1851779e95f43caa01b
-
SSDEEP
6144:KNaJPbCwC6WmA1JEAFDLQWP+zKPup8Gve+6SNIQFbJh6WPGmtSCT4az9dvRR:KoJzPekk+zu/crNI+2Sio4az9d5R
Malware Config
Extracted
xloader
2.5
inga
21sq.xyz
aleimanpaper.com
soulworkerrush.com
lianxiwan.xyz
gorastionse.store
nuhuo333.xyz
greenft.xyz
upisout.com
mgav23.xyz
2day-recv.info
emdestak.com
generatorgmer.xyz
inmyhindi.com
meenubhosale.com
feinquebrantabledoc.com
valgtrizoma.quest
impqtantaou.com
nomorewarnow.com
gmcrjizppcx.mobi
eludice.net
Targets
-
-
Target
d27ea95cff227c46dfbe2cb9dfa6f746633ac5c6f548a0c18a3bb8af7c3017b8
-
Size
527KB
-
MD5
829de14ff481bf90b296a2bb418daf81
-
SHA1
b7976a8fda3f0f27366cd0b0f487ae4de77e64f7
-
SHA256
d27ea95cff227c46dfbe2cb9dfa6f746633ac5c6f548a0c18a3bb8af7c3017b8
-
SHA512
ae402ef574a54fe15ef0bb437588f222dbaa90065fa1a0780e35d6e52809f4429ca2717f21d9cd7e81ab89b5d046691640bee2bcead0ef48e1f0d029eae1d15c
-
SSDEEP
6144:3iefhzZgSqsNo44jy/mP1ia/B/xZfp/FbOkYDMXVApBAdTt0WYnHeZ3Cfkq6fnKf:3icuS5z/QbpPeDMXVA3CaWjyfUOTC
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
Xloader payload
-
Suspicious use of SetThreadContext
-