General
-
Target
de042e38d84cf16252496d8330eacf1b_JaffaCakes118
-
Size
585KB
-
Sample
240406-hk93nade97
-
MD5
de042e38d84cf16252496d8330eacf1b
-
SHA1
cf808849aa0afbf36dbcd71a63499da2132f52d1
-
SHA256
64c3c3a5004d786f14ced03e295463bebaa1ab08c59b8287001c15aac69e3521
-
SHA512
1f6cf41e7706e7e6b717aaeb5c83bd0dfa74d2038cff02e146dc9d4718e398db67621e51e94287d5f320b9ea7a372fb2b31dafa81b0a86bdcc2033fd723da2a3
-
SSDEEP
12288:ny3bU4N/HJRNwwC6dQ7HG+4FnjLlOhsxeHHV:0fJrPZQ7HGhBpOyxenV
Malware Config
Extracted
xloader
2.5
fqiq
driventow.com
ipatchwork.today
bolder.equipment
seal-brother.com
mountlaketerraceapartments.com
weeden.xyz
sanlifalan.com
athafood.com
isshinn1.com
creationslazzaroni.com
eclecticrenaissancewoman.com
satellitephonstore.com
cotchildcare.com
yamacorp.digital
ff4cuno43.xyz
quicksticks.community
govindfinance.com
farmersfirstseed.com
megacinema.club
tablescaperendezvous4two.com
Targets
-
-
Target
de042e38d84cf16252496d8330eacf1b_JaffaCakes118
-
Size
585KB
-
MD5
de042e38d84cf16252496d8330eacf1b
-
SHA1
cf808849aa0afbf36dbcd71a63499da2132f52d1
-
SHA256
64c3c3a5004d786f14ced03e295463bebaa1ab08c59b8287001c15aac69e3521
-
SHA512
1f6cf41e7706e7e6b717aaeb5c83bd0dfa74d2038cff02e146dc9d4718e398db67621e51e94287d5f320b9ea7a372fb2b31dafa81b0a86bdcc2033fd723da2a3
-
SSDEEP
12288:ny3bU4N/HJRNwwC6dQ7HG+4FnjLlOhsxeHHV:0fJrPZQ7HGhBpOyxenV
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-