General
-
Target
c3f0505001277d2b23d8acc658800c35_JaffaCakes118
-
Size
585KB
-
Sample
240404-2vmjwscf5t
-
MD5
c3f0505001277d2b23d8acc658800c35
-
SHA1
b7eb8afcf3f7eb35d71c2b1fec6c3b099a57ec9e
-
SHA256
1d3c91b0ec0e3b039a78c042eec94a3aebbe5da4d6e61cf7b7e54de22084d4a3
-
SHA512
6acc7eeabca609f1ffb00789652a20c97b56b664f0f33574b665024b152e8ebb90c03b11a7a84008900358a387d7713f9963f04cb8af3f711b2f9500a29d8704
-
SSDEEP
12288:y4n3bUzN/aLflq8FJwY1z6eRuQtbbtLlOhsxeHH:N6CRSY1X99ppOyxen
Malware Config
Extracted
xloader
2.5
fqiq
driventow.com
ipatchwork.today
bolder.equipment
seal-brother.com
mountlaketerraceapartments.com
weeden.xyz
sanlifalan.com
athafood.com
isshinn1.com
creationslazzaroni.com
eclecticrenaissancewoman.com
satellitephonstore.com
cotchildcare.com
yamacorp.digital
ff4cuno43.xyz
quicksticks.community
govindfinance.com
farmersfirstseed.com
megacinema.club
tablescaperendezvous4two.com
Targets
-
-
Target
c3f0505001277d2b23d8acc658800c35_JaffaCakes118
-
Size
585KB
-
MD5
c3f0505001277d2b23d8acc658800c35
-
SHA1
b7eb8afcf3f7eb35d71c2b1fec6c3b099a57ec9e
-
SHA256
1d3c91b0ec0e3b039a78c042eec94a3aebbe5da4d6e61cf7b7e54de22084d4a3
-
SHA512
6acc7eeabca609f1ffb00789652a20c97b56b664f0f33574b665024b152e8ebb90c03b11a7a84008900358a387d7713f9963f04cb8af3f711b2f9500a29d8704
-
SSDEEP
12288:y4n3bUzN/aLflq8FJwY1z6eRuQtbbtLlOhsxeHH:N6CRSY1X99ppOyxen
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-