General
-
Target
242f6abffd1b5ac336295105b07817c000c94256082b63928fb1b149b6865209
-
Size
763KB
-
Sample
241121-ynf7razqaj
-
MD5
50890ed42291e55c22fe0dba7a183798
-
SHA1
587ab1131bd1699b5be32b0a9b19332691ab7b1e
-
SHA256
242f6abffd1b5ac336295105b07817c000c94256082b63928fb1b149b6865209
-
SHA512
7ecf1a4372684230cfac6e6ebe374e3dab80952213cfb049de99bbd992199a530a5a3ee3616a21e461dad3a2be3e1e31ccf5ce8665d257fa4390d826dd60d5cf
-
SSDEEP
12288:nvFNgOJJmsfGUUV4AsO8X+xwvF/eal0mwVE2gXAQAFl8LdUxVekNM1Yn25WB0CZa:vF9nnGKALxw6mUbgXoadUxQtWnS6ZthG
Malware Config
Extracted
xloader
2.3
a8si
mosquitocontrolpro.com
omfgphil.com
qqkit.net
compusolutionsac.com
skynetaccess.com
helmetmoto.com
webdomoupravitel.com
thepocket-onlinelesson.xyz
stefaniehirsch.space
goalsandballs.com
xn--bro-ba-3ya.com
tomrings.com
4520oceanviewavenue.com
mamaebemorientada.com
shopwreathrails.com
restaurantestancia.com
annaquatics.info
mnarchitect.design
best-cleaner.com
jobhuizhan.com
Targets
-
-
Target
e3840b075daf6dc551b27af25e1f267859424be0383df415e554c1630f47f06d
-
Size
1.0MB
-
MD5
2a18e326c67bc62fadf1b897e2653c47
-
SHA1
67b5e4920118d62f37b15c0746d691a00e457309
-
SHA256
e3840b075daf6dc551b27af25e1f267859424be0383df415e554c1630f47f06d
-
SHA512
018fb7459624a6707a26471ec0b8450ced219d4b7abd5ffcfff36c60455809de393eb204a427be6a91b134bc33d4baf12e6baf707f2218e250f5b80b69285ec7
-
SSDEEP
24576:wAEhaozWd4qjKlwrb7ddYVvgebPkAZv5nPW3Ry2Z:wrzK82fhOVNb8AZv5nPw82Z
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Xloader payload
-
Suspicious use of SetThreadContext
-