General
-
Target
87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118
-
Size
373KB
-
Sample
240402-kjc3msce27
-
MD5
87cd2ddf31c62ed3219d2c559d4a9cb6
-
SHA1
778feade270eae6041a76bb962c42b5b85d9199d
-
SHA256
e4a4e1f73cbbd5667b5264b48bc7429ea638532d08e78d53b86b86c0fa5b291b
-
SHA512
92a946f2f060eea48533efd71bde81b14ec1a6d969a64b87eea37489625aba1f8959cab50077fb8f99d8d6285766675343b6c2b130b8a1831b2beb1828ff1df0
-
SSDEEP
6144:bjaohYpyMkhBTJKLDW5dhpTTsdXJWqAIdYrSLdal3tUC80o+cCBtQsIAUVru:PaoYSBTJnhpUdZbverSxtC8Tc6uIi
Malware Config
Extracted
xloader
2.5
ef6c
gicaredocs.com
govusergroup.com
conversationspit.com
brondairy.com
rjtherealest.com
xn--9m1bq8wgkag3rjvb.com
mylori.net
softandcute.store
ahljsm.com
shacksolid.com
weekendmusecollection.com
gaminghallarna.net
pgonline111.online
44mpt.xyz
ambrandt.com
eddytattoo.com
blendeqes.com
upinmyfeels.com
lacucinadesign.com
docomoau.xyz
Targets
-
-
Target
87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118
-
Size
373KB
-
MD5
87cd2ddf31c62ed3219d2c559d4a9cb6
-
SHA1
778feade270eae6041a76bb962c42b5b85d9199d
-
SHA256
e4a4e1f73cbbd5667b5264b48bc7429ea638532d08e78d53b86b86c0fa5b291b
-
SHA512
92a946f2f060eea48533efd71bde81b14ec1a6d969a64b87eea37489625aba1f8959cab50077fb8f99d8d6285766675343b6c2b130b8a1831b2beb1828ff1df0
-
SSDEEP
6144:bjaohYpyMkhBTJKLDW5dhpTTsdXJWqAIdYrSLdal3tUC80o+cCBtQsIAUVru:PaoYSBTJnhpUdZbverSxtC8Tc6uIi
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-