General
-
Target
939813ca92f2bae5706d2a9124b6de305130a98e62b0d8c30efe276d5ba427a3
-
Size
469KB
-
Sample
241121-yr2ymawmbw
-
MD5
172b8f239331f2b4e531616307206edf
-
SHA1
5b69455b43ee91710b1ab0045cfb01f678b190a1
-
SHA256
939813ca92f2bae5706d2a9124b6de305130a98e62b0d8c30efe276d5ba427a3
-
SHA512
ee80153c9713a872a401d6282b97ab36c1ec38ca826d48e6fcfb84d9ec98f0e4bfc53dd74dba11a37361c8b0cbbfeb9f37ac8334df7d72a2f42678ee546afe65
-
SSDEEP
12288:ubceVAeBQrV2jWyPs92JOyvCdLq6CDe6G9:KceVAjMSWNOyaBq6CDH6
Malware Config
Extracted
xloader
2.5
e3rs
onewebuy.net
polley-marketing.com
suddennnnnnnnnnnn40.xyz
pozowater.com
finaliz2rinfo.com
marblesenglish.com
ff-member-gasena.com
hqg168.com
sbeinvest.com
8038959.win
ccafgz.com
auburnradiancecavern.com
advertisingamanda.info
flowerdeliverydrones.com
xpzzz.com
elbauldepecas.com
qtwzdw.com
luvlock.info
8977dd.com
themakeupsquare.com
Targets
-
-
Target
939813ca92f2bae5706d2a9124b6de305130a98e62b0d8c30efe276d5ba427a3
-
Size
469KB
-
MD5
172b8f239331f2b4e531616307206edf
-
SHA1
5b69455b43ee91710b1ab0045cfb01f678b190a1
-
SHA256
939813ca92f2bae5706d2a9124b6de305130a98e62b0d8c30efe276d5ba427a3
-
SHA512
ee80153c9713a872a401d6282b97ab36c1ec38ca826d48e6fcfb84d9ec98f0e4bfc53dd74dba11a37361c8b0cbbfeb9f37ac8334df7d72a2f42678ee546afe65
-
SSDEEP
12288:ubceVAeBQrV2jWyPs92JOyvCdLq6CDe6G9:KceVAjMSWNOyaBq6CDH6
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
Xloader payload
-
Suspicious use of SetThreadContext
-