General
-
Target
4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118
-
Size
585KB
-
Sample
240331-e2lvlsec76
-
MD5
4d10925c2d52223135b1a2e069bc5ab0
-
SHA1
1eb2a075efe3f17fecfdd9d4cc5d39266e5cd162
-
SHA256
832c65a202ec1c69a8297af3d2fc3d233ac65b7c2c670f30d0694089601c9cfe
-
SHA512
7708579ba479c687705cec9ed5eb9d0ef30339c8cb50d18677d00f05fb37f403fbf56d8101ba9dd93a8216d1ee316e07ae4bb2667feab0ee889e06bff810164a
-
SSDEEP
12288:j+3bUfN/EH056Nvdg0nRrR9rWWy+vdLlOhsxeHH:HC0YtqGvWVapOyxen
Malware Config
Extracted
xloader
2.5
fqiq
driventow.com
ipatchwork.today
bolder.equipment
seal-brother.com
mountlaketerraceapartments.com
weeden.xyz
sanlifalan.com
athafood.com
isshinn1.com
creationslazzaroni.com
eclecticrenaissancewoman.com
satellitephonstore.com
cotchildcare.com
yamacorp.digital
ff4cuno43.xyz
quicksticks.community
govindfinance.com
farmersfirstseed.com
megacinema.club
tablescaperendezvous4two.com
Targets
-
-
Target
4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118
-
Size
585KB
-
MD5
4d10925c2d52223135b1a2e069bc5ab0
-
SHA1
1eb2a075efe3f17fecfdd9d4cc5d39266e5cd162
-
SHA256
832c65a202ec1c69a8297af3d2fc3d233ac65b7c2c670f30d0694089601c9cfe
-
SHA512
7708579ba479c687705cec9ed5eb9d0ef30339c8cb50d18677d00f05fb37f403fbf56d8101ba9dd93a8216d1ee316e07ae4bb2667feab0ee889e06bff810164a
-
SSDEEP
12288:j+3bUfN/EH056Nvdg0nRrR9rWWy+vdLlOhsxeHH:HC0YtqGvWVapOyxen
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-