General

  • Target

    d3f9895ad53fed9a59919eac83de1992_JaffaCakes118

  • Size

    585KB

  • Sample

    240405-pwrh1scc9s

  • MD5

    d3f9895ad53fed9a59919eac83de1992

  • SHA1

    982753997a748d691c93f2aad18f8ffd6961dcc8

  • SHA256

    dc8324152892b2fc30fd2574d990150aeecbe7b3e5b871d884c6644a16ede4ed

  • SHA512

    356e4231d898db79beba4701ba49cd7a053be6be34fecf62331b6f4bb69c9492f1c065f4b6c943886e4999042cb577e7ac5c5df4d96958a7446179aff2bb4bdc

  • SSDEEP

    12288:y4n3bUzN/aLflq8FJwY1z6eRuQtbbtLlOhsxeHHm:N6CRSY1X99ppOyxenm

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

fqiq

Decoy

driventow.com

ipatchwork.today

bolder.equipment

seal-brother.com

mountlaketerraceapartments.com

weeden.xyz

sanlifalan.com

athafood.com

isshinn1.com

creationslazzaroni.com

eclecticrenaissancewoman.com

satellitephonstore.com

cotchildcare.com

yamacorp.digital

ff4cuno43.xyz

quicksticks.community

govindfinance.com

farmersfirstseed.com

megacinema.club

tablescaperendezvous4two.com

Targets

    • Target

      d3f9895ad53fed9a59919eac83de1992_JaffaCakes118

    • Size

      585KB

    • MD5

      d3f9895ad53fed9a59919eac83de1992

    • SHA1

      982753997a748d691c93f2aad18f8ffd6961dcc8

    • SHA256

      dc8324152892b2fc30fd2574d990150aeecbe7b3e5b871d884c6644a16ede4ed

    • SHA512

      356e4231d898db79beba4701ba49cd7a053be6be34fecf62331b6f4bb69c9492f1c065f4b6c943886e4999042cb577e7ac5c5df4d96958a7446179aff2bb4bdc

    • SSDEEP

      12288:y4n3bUzN/aLflq8FJwY1z6eRuQtbbtLlOhsxeHHm:N6CRSY1X99ppOyxenm

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks