General
-
Target
9cbb1a3941ebffdd5727d36b8eb4cbb8a4fdd628e450fbf037f4fce879ce2546
-
Size
230KB
-
Sample
241121-yyp8eawpdv
-
MD5
367efd281d8b92d592008c048dfac82a
-
SHA1
d073c3f095276e156bd18189e624d8fe50797ce1
-
SHA256
9cbb1a3941ebffdd5727d36b8eb4cbb8a4fdd628e450fbf037f4fce879ce2546
-
SHA512
becc955b7d0ffb633ff24f90242d7edbb3c16b4f8bec0018ca312146740796863ca4149b7a0260fe6acd445c0e57e650de3ce9edbcca193638b52ead94ebb997
-
SSDEEP
6144:1rEvZ4uyMt5W86x46K8dFoWrvmP9zxjuw7spQh695qijV:14B4u3zw46VFVKVH7s+h6jhjV
Malware Config
Extracted
xloader
2.5
d0ce
spellfield.com
vanjmkt.com
exclusivedrone.store
happyworkdayacademy.com
motometics.com
mumkungiyim.com
alborosso.com
houstonafterparties.com
wilcoxserviceinc.com
proud2bblack.com
annikadaniel.love
elefantesenelcloset.com
cryptoisthedrug.com
kuroda-implant.com
instaladoresvilafranca.com
orthozayn.com
ebuyivermectin.com
centroserviziseclensrls.com
benefitcarolina.com
wkfdymfxmyckr.com
Targets
-
-
Target
D21349_R01.exe
-
Size
368KB
-
MD5
8257cfda4bcf7f729bb54f202c2fcbe8
-
SHA1
a92d8320d2c0b25bb519b4186c1cea1bf106c049
-
SHA256
b1dd2798d89f66d87e984ac3020a0ddc6741c6a845fa6df3d5e3a27ac08e791d
-
SHA512
9a6bf3c40d59ac40ef1d7b370dd12cf8ec207693bd3ffd85daf98aab6de7f24d13e0364558d511c31d1965adb024f04375a7ff0c4035a859ea2ce06c7a6721fe
-
SSDEEP
6144:h/DDAs9TKoUjNVl6tGrFWGDvtww8Yxw7YURz6t776Qgl/u0O0:h/MoUjNVl3rkGDvtww8Yxw7Yf7n0
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
Xloader payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-