General
-
Target
ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118
-
Size
337KB
-
Sample
240405-j6q3cafb8s
-
MD5
ce5a9b1b89a57e526ee1347645b25000
-
SHA1
a30d421092b052f05ad0861c63d720404805bdcc
-
SHA256
d567a6e6ac075533ef1960033ab07c0afed9638c785ccb3a9461195785ac9636
-
SHA512
9db51bc3a0199f2cd374edd9f92c250dfb36670bd1bb76398241c1a0604502e00106c439cee31ffe0e79ee14e8ba89962e95a878e7f30c5bd855f2c8fe4afc80
-
SSDEEP
6144:e0tgMkhBORh50cUZzKDj8jd8EM4lnt91AMv4o4EE77DqOKyOmRQBQ7Y:dSBaPYyAm4ljyF7/qOKmRg
Malware Config
Extracted
xloader
2.5
fqiq
driventow.com
ipatchwork.today
bolder.equipment
seal-brother.com
mountlaketerraceapartments.com
weeden.xyz
sanlifalan.com
athafood.com
isshinn1.com
creationslazzaroni.com
eclecticrenaissancewoman.com
satellitephonstore.com
cotchildcare.com
yamacorp.digital
ff4cuno43.xyz
quicksticks.community
govindfinance.com
farmersfirstseed.com
megacinema.club
tablescaperendezvous4two.com
Targets
-
-
Target
ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118
-
Size
337KB
-
MD5
ce5a9b1b89a57e526ee1347645b25000
-
SHA1
a30d421092b052f05ad0861c63d720404805bdcc
-
SHA256
d567a6e6ac075533ef1960033ab07c0afed9638c785ccb3a9461195785ac9636
-
SHA512
9db51bc3a0199f2cd374edd9f92c250dfb36670bd1bb76398241c1a0604502e00106c439cee31ffe0e79ee14e8ba89962e95a878e7f30c5bd855f2c8fe4afc80
-
SSDEEP
6144:e0tgMkhBORh50cUZzKDj8jd8EM4lnt91AMv4o4EE77DqOKyOmRQBQ7Y:dSBaPYyAm4ljyF7/qOKmRg
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-