General

  • Target

    d40d16f11bd6a0f337f9e5ea381cc9da_JaffaCakes118

  • Size

    585KB

  • Sample

    240405-pymylsda77

  • MD5

    d40d16f11bd6a0f337f9e5ea381cc9da

  • SHA1

    abcce81167138b25b794617bc0998db3337ecd6e

  • SHA256

    abf5690018f60f621f9bd9e5e342d310825e3b3ad2d8ddfb0c5b1b0de95ee846

  • SHA512

    c727da32eeca51397249b798c5faf3537af508f945a125624b082edbbed07ca26b405943c91728d0a738e51d89c3324c2b152be660b7da63c2a746bfa2799157

  • SSDEEP

    12288:y4n3bUzN/aLflq8FJwY1z6eRuQtbbtLlOhsxeHHk:N6CRSY1X99ppOyxenk

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

fqiq

Decoy

driventow.com

ipatchwork.today

bolder.equipment

seal-brother.com

mountlaketerraceapartments.com

weeden.xyz

sanlifalan.com

athafood.com

isshinn1.com

creationslazzaroni.com

eclecticrenaissancewoman.com

satellitephonstore.com

cotchildcare.com

yamacorp.digital

ff4cuno43.xyz

quicksticks.community

govindfinance.com

farmersfirstseed.com

megacinema.club

tablescaperendezvous4two.com

Targets

    • Target

      d40d16f11bd6a0f337f9e5ea381cc9da_JaffaCakes118

    • Size

      585KB

    • MD5

      d40d16f11bd6a0f337f9e5ea381cc9da

    • SHA1

      abcce81167138b25b794617bc0998db3337ecd6e

    • SHA256

      abf5690018f60f621f9bd9e5e342d310825e3b3ad2d8ddfb0c5b1b0de95ee846

    • SHA512

      c727da32eeca51397249b798c5faf3537af508f945a125624b082edbbed07ca26b405943c91728d0a738e51d89c3324c2b152be660b7da63c2a746bfa2799157

    • SSDEEP

      12288:y4n3bUzN/aLflq8FJwY1z6eRuQtbbtLlOhsxeHHk:N6CRSY1X99ppOyxenk

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks