General
-
Target
ed56b844097dbb24e768aa5b08ee77b5_JaffaCakes118
-
Size
714KB
-
Sample
240411-nvp35adh41
-
MD5
ed56b844097dbb24e768aa5b08ee77b5
-
SHA1
95410dca7795f5f150758c29cca952e058720a90
-
SHA256
1c49c90dceca146ee0b95fab3873e38bcda5b46b550a59f8ba2ccf5984a11b92
-
SHA512
0a8e771a163e95d7835dcf15c469e3b6d681fc5932256e374e2c9f0a69141f7a493207c40a143996e2508f0f4ea4896d34247af5021013c30bab7946f74b29b9
-
SSDEEP
12288:1okY8tYPdd2f1SZj5R9q+EWAKo17j3Cwcu0HK7zWt6UJ9r1Rp3Crzo6nZNe+op/N:dEdR9tANjogz49p4o0SX/7yScBcOba4C
Malware Config
Extracted
xloader
2.3
ssee
portalcanaa.com
korzino.com
dlylms.net
smartearphoneshop.com
olimiloshop.com
auvdigitalstack.com
ydxc.chat
yhk868.com
lifeinthedport.com
self-sciencelabs.com
scandicpack.com
hold-sometimes.xyz
beiputei.com
yourrealtorcoach.com
rxods.com
fundsoption.com
ahlstromclothes.com
ksdieselparts.com
accountmangerford.com
kuwaitlogistic.com
Targets
-
-
Target
ed56b844097dbb24e768aa5b08ee77b5_JaffaCakes118
-
Size
714KB
-
MD5
ed56b844097dbb24e768aa5b08ee77b5
-
SHA1
95410dca7795f5f150758c29cca952e058720a90
-
SHA256
1c49c90dceca146ee0b95fab3873e38bcda5b46b550a59f8ba2ccf5984a11b92
-
SHA512
0a8e771a163e95d7835dcf15c469e3b6d681fc5932256e374e2c9f0a69141f7a493207c40a143996e2508f0f4ea4896d34247af5021013c30bab7946f74b29b9
-
SSDEEP
12288:1okY8tYPdd2f1SZj5R9q+EWAKo17j3Cwcu0HK7zWt6UJ9r1Rp3Crzo6nZNe+op/N:dEdR9tANjogz49p4o0SX/7yScBcOba4C
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-