General
-
Target
8a968e412a3f5212e36a69d429dc0a2be143e70ad6ffe7c2b4a9bb4ab19ca045
-
Size
561KB
-
Sample
241121-ynad7szphp
-
MD5
6bbea0774716cb99abe78cf55fb69c71
-
SHA1
acb158639605ebef5016a58bc2e651783a977098
-
SHA256
8a968e412a3f5212e36a69d429dc0a2be143e70ad6ffe7c2b4a9bb4ab19ca045
-
SHA512
902c480638e45017e5bac0cbd7da084744113c2b9c88a58b7fbb58d6ceca847bad69e34485ac5f937136eeaadfc74907f3099de73c7cf80411b2c9aee5b53740
-
SSDEEP
12288:rb1U/iCsDKMwZsfOOhJC3h4Q9VaOtFG5KMN4ZHGbS1khy:r5Ua1DK/smOhJohrG5BN4Z11Ky
Malware Config
Extracted
xloader
2.3
cttb
annarbor-weeddelivery.com
capquangept.com
mind.srl
blazingboard.com
wecallnzhome.com
moritamorio.com
jyxq.net
dabanse.com
luma-dating.com
2020won.com
lucydemo63.com
misskarenenglisheacher.com
tuckersucks.com
northeastprivacy.com
whipitinventions.com
casino-r6.club
asmrempowerment.com
topkids.asia
mattressmonth.com
antivirus-zastita.com
Targets
-
-
Target
b5aa56b1df29b386fdc8ab5b37b5c9b6d82ce07ada2d7dfa72e032ed85bc4989
-
Size
585KB
-
MD5
dde77a728a1b702ff6a33abbae4355e7
-
SHA1
04787344a6c90238784e02ba7163c05d11a9b9be
-
SHA256
b5aa56b1df29b386fdc8ab5b37b5c9b6d82ce07ada2d7dfa72e032ed85bc4989
-
SHA512
0445494258b61c3f2235bd6bf0bf33dbd627f247eb27973c4b706385c952d8d718499c9aaad2899d11944e821bc45f64928ccb04ad18e9dbeee7b4f71243de76
-
SSDEEP
12288:rXe9PPlowWX0t6mOQwg1Qd15CcYk0We10p5WViXp0VFarPjvBf+rn+4:yhloDX0XOf48+Y6VFINmF
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
Xloader payload
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-