General
-
Target
d3f9895ad53fed9a59919eac83de1992_JaffaCakes118
-
Size
585KB
-
Sample
240405-pwrh1scc9s
-
MD5
d3f9895ad53fed9a59919eac83de1992
-
SHA1
982753997a748d691c93f2aad18f8ffd6961dcc8
-
SHA256
dc8324152892b2fc30fd2574d990150aeecbe7b3e5b871d884c6644a16ede4ed
-
SHA512
356e4231d898db79beba4701ba49cd7a053be6be34fecf62331b6f4bb69c9492f1c065f4b6c943886e4999042cb577e7ac5c5df4d96958a7446179aff2bb4bdc
-
SSDEEP
12288:y4n3bUzN/aLflq8FJwY1z6eRuQtbbtLlOhsxeHHm:N6CRSY1X99ppOyxenm
Malware Config
Extracted
xloader
2.5
fqiq
driventow.com
ipatchwork.today
bolder.equipment
seal-brother.com
mountlaketerraceapartments.com
weeden.xyz
sanlifalan.com
athafood.com
isshinn1.com
creationslazzaroni.com
eclecticrenaissancewoman.com
satellitephonstore.com
cotchildcare.com
yamacorp.digital
ff4cuno43.xyz
quicksticks.community
govindfinance.com
farmersfirstseed.com
megacinema.club
tablescaperendezvous4two.com
Targets
-
-
Target
d3f9895ad53fed9a59919eac83de1992_JaffaCakes118
-
Size
585KB
-
MD5
d3f9895ad53fed9a59919eac83de1992
-
SHA1
982753997a748d691c93f2aad18f8ffd6961dcc8
-
SHA256
dc8324152892b2fc30fd2574d990150aeecbe7b3e5b871d884c6644a16ede4ed
-
SHA512
356e4231d898db79beba4701ba49cd7a053be6be34fecf62331b6f4bb69c9492f1c065f4b6c943886e4999042cb577e7ac5c5df4d96958a7446179aff2bb4bdc
-
SSDEEP
12288:y4n3bUzN/aLflq8FJwY1z6eRuQtbbtLlOhsxeHHm:N6CRSY1X99ppOyxenm
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-