General
-
Target
c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118
-
Size
425KB
-
Sample
240404-x965magh83
-
MD5
c0e07faebfd4b0977ac802e3bc73958a
-
SHA1
0277d0bc9bc70b7b013adb9e7500dd0cbd0b863e
-
SHA256
506458aaeef61f70cf73da3d71d5452cd859cfd9fbcc7cf515d27265ace2421d
-
SHA512
7ce148455e4a6152ac5ede04e595cafcb5e9363efc0d79552726a34fc1b7b595028758774d4358f581ec12a1a0a8823e5aa2dcc226a20763d32f17c95d6aa752
-
SSDEEP
6144:i6Uqd2GhNOQVwKtCcaEyfM2Q4NmbBggh13Rtm1DnMaKvzmr3:fUi2iNOQVlVPOTpqBtUDnMamQ
Malware Config
Extracted
xloader
2.5
euzn
235296tyc.com
gold12guide.art
baibuaherb.com
weberwines.tax
chezvitoria.com
aidenb.tech
pitchdeckservice.com
surgeryforfdf.xyz
workunvaccinated.com
hrtaro.com
yourotcs.com
sonimultispecialityclinic.com
consultantadvisors.com
pentesting-consulting.com
dantechs.digital
longshifa.online
taweilai.net
imyusuke.com
cashndashfinancial.com
fasiglimt.quest
Targets
-
-
Target
c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118
-
Size
425KB
-
MD5
c0e07faebfd4b0977ac802e3bc73958a
-
SHA1
0277d0bc9bc70b7b013adb9e7500dd0cbd0b863e
-
SHA256
506458aaeef61f70cf73da3d71d5452cd859cfd9fbcc7cf515d27265ace2421d
-
SHA512
7ce148455e4a6152ac5ede04e595cafcb5e9363efc0d79552726a34fc1b7b595028758774d4358f581ec12a1a0a8823e5aa2dcc226a20763d32f17c95d6aa752
-
SSDEEP
6144:i6Uqd2GhNOQVwKtCcaEyfM2Q4NmbBggh13Rtm1DnMaKvzmr3:fUi2iNOQVlVPOTpqBtUDnMamQ
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-