General
-
Target
487037ef86c737e048438eb25320f0667558d8faac0e8795b05a81323dd6430e
-
Size
269KB
-
Sample
241121-y9lz5axkcy
-
MD5
9b12e6998a33dd308a17658845356e83
-
SHA1
0c134dee4340cb905eccd45dcf88ccdbdffbaa73
-
SHA256
487037ef86c737e048438eb25320f0667558d8faac0e8795b05a81323dd6430e
-
SHA512
4085d9e4ff62d776c265e90e768b7b558b1fc4713d6ff1214b7351f8b3fc120a184b2b7be41c0902aa031e25b37a85c42d6ca881308b07a7810c25d67c584a03
-
SSDEEP
6144:geyplVXtCnUPNVZkClL5PlHcmef27bHsJIDT0HAZu:CplvCUVVZkClLK2vUILu
Malware Config
Extracted
xloader
2.5
seqa
alstartnpasumo5.xyz
jarvisbranding.com
kyiv-bdsm.club
hunttools.info
bantaleautomotiveengineers.com
comercioexpresschilpancingo.com
smallbusinessalliancegroup.com
swlawfirmok.com
marketciphermerch.com
gxmmvcn.icu
betwonsikayet.com
bise.tech
minismi2.com
bucklestylez.com
hereford-cattle.com
yufude.com
tangerineinit.com
destinyforfreedom.com
team-rwby-project.com
richardkmartinez.store
Targets
-
-
Target
f65dccca258ad9ea722aa7a66188f55f5f80a274bb9090a02f4c3b6d7ef9fe5e.bin
-
Size
533KB
-
MD5
74dcc6e092f153a156440a45476dd3d9
-
SHA1
9c625f5c2bde5235f406fe6d08e52d5c39d627ed
-
SHA256
f65dccca258ad9ea722aa7a66188f55f5f80a274bb9090a02f4c3b6d7ef9fe5e
-
SHA512
c33a3a6f59666c90947967520b82d8a77abd07bcfc13b9aadf5cedf641e3b337d68f21c93345a887371a06641ad88ece7074af146cd4fba021c68fce95363ab3
-
SSDEEP
12288:IgOUT6enUemHO2OxwYcosOmRm+meGbbp2:IFNu2O/uQdN2
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
Xloader payload
-
Suspicious use of SetThreadContext
-