General
-
Target
88afba3ab41eb212878ade4a7aede378b12a1342e8f0172b14cb45275dfb8b8c
-
Size
1.0MB
-
Sample
241121-zm3vssxnd1
-
MD5
1ad365f70659ba21e9c40858c124c417
-
SHA1
6de0fc8d5d3843cf5edd7ecda969e211f834f28d
-
SHA256
88afba3ab41eb212878ade4a7aede378b12a1342e8f0172b14cb45275dfb8b8c
-
SHA512
f8e608e1020764ab560068e9be0c4296265982f3f513bd60d6bb53d7a1f6821c6de148693f9b99a56b446381b71dc410cbfe12db7c2bc8be73c4efeb11abf151
-
SSDEEP
24576:IbD5v52AjOotJ9/6jUHJQ6jfeDaQiMRmoEyJJOR0mVgez4H7S5KZV4:cD5vjR9/0eheDnjRb+VHkH77Zi
Malware Config
Extracted
xloader
2.5
iepw
isabellechiritoiabogada.com
singaporeimpact.com
mdcxdgkr.com
fivestasrelectriccorp.com
apaspaa.com
datashen.com
yh2.space
remediationnews.com
randlesrice.com
mailclic.digital
n83a.com
wmeacc.com
cahuvoa.xyz
h0t-now.com
admtrans.com
yghdlhax.xyz
bakshipping.com
ambermariemusic.com
mandelbot.tech
cryptoassetmanager.xyz
Targets
-
-
Target
neue_bestellung_49023.exe
-
Size
1.3MB
-
MD5
79acd16cc721413e45d0f6987b2341e8
-
SHA1
2a84d0863dc70a2e9720c4f6ea2fde05d7eb25bb
-
SHA256
8f3deece688aa33294622610ff9e48cedc8aa6ac0ea2446808e932b626fd011c
-
SHA512
481c9758514456c2978e4b5e790831dd18987edd1e0c449467dd8843f924b2cf4c1c5914fb0c96b13b636bd64ef8926bf493f259dd24bd5ce4000cf693291b56
-
SSDEEP
24576:hK1B9HUcp/rVBHjz5MN5QTPF4Us9PHy7BOiSGtWyJcwTCBu2YxUtmP:41B+CR95MTq9X7TSGMyJnA8x8m
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
Xloader payload
-
Suspicious use of SetThreadContext
-