General
-
Target
e2bbb850c21363d228dc24d273e1a8a9_JaffaCakes118
-
Size
503KB
-
Sample
240406-rpqz1scc3v
-
MD5
e2bbb850c21363d228dc24d273e1a8a9
-
SHA1
fd22b3c7eb8baf4a5f73cb32340c1503cc5d2b2a
-
SHA256
7f41f56fccf71bcb0c1f50d11e9d05a0342cd08a3a27d55d31cffe0ef95b2272
-
SHA512
9dc5863692a3c505f3a2856ebe1cb2bc5bc33db5293393cf004e45f90b0dbf24eb85248464a3d3d849c33ec7e310e022956ab7c295136bf0ee3bffcd4874e098
-
SSDEEP
12288:AfOusTlZ4F8YdfUMhIwWbm8RN5qlGeiSLRMcfj/i2CuAUgh:AWuyZRYdfJhIwWKOPqs3Qfj
Malware Config
Extracted
xloader
2.3
n58i
nl-cafe.com
votetedjaleta.com
britrobertsrealtor.com
globipark.com
citysucces.com
verisignwebsite-verified.com
riddlepc.com
rosecityclimbing.com
oleandrinextract.com
salmankonstruksi.com
needhamchannel.com
refreshx2z.com
youth66.com
pla-russia.com
halloweenmaskpro.com
exdysis.com
1gcz.com
lookgoodman.com
rlxagva.com
stlcityc.com
Targets
-
-
Target
e2bbb850c21363d228dc24d273e1a8a9_JaffaCakes118
-
Size
503KB
-
MD5
e2bbb850c21363d228dc24d273e1a8a9
-
SHA1
fd22b3c7eb8baf4a5f73cb32340c1503cc5d2b2a
-
SHA256
7f41f56fccf71bcb0c1f50d11e9d05a0342cd08a3a27d55d31cffe0ef95b2272
-
SHA512
9dc5863692a3c505f3a2856ebe1cb2bc5bc33db5293393cf004e45f90b0dbf24eb85248464a3d3d849c33ec7e310e022956ab7c295136bf0ee3bffcd4874e098
-
SSDEEP
12288:AfOusTlZ4F8YdfUMhIwWbm8RN5qlGeiSLRMcfj/i2CuAUgh:AWuyZRYdfJhIwWKOPqs3Qfj
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-