General
-
Target
f02f2961032796a25c7e090bb4f70566_JaffaCakes118
-
Size
252KB
-
Sample
240415-dve8tadc47
-
MD5
f02f2961032796a25c7e090bb4f70566
-
SHA1
8c530a1533800db7d8dea165ea93421e2c996dad
-
SHA256
7a34064785bd677a927fa90988d9001aed285762f230d0fe08db7b2ca89ce987
-
SHA512
92df5ef56be6a6f5eeaeeb9b11559ca0a2960de9e7e0ba3a24308d603fa7be3375e41f7a618b6d02a4d7739b3ac75ba91203bf2ecfe963689539bc05dcdb0507
-
SSDEEP
6144:Ld53TvpHeIl0l7o0YJvxPfqAg2bwejuDjwZbC9sU7ltYp9f7OANxB:Ld53TvpHeIl0l7ohBv0fAbCHTyqA
Malware Config
Extracted
xloader
2.3
dzqd
weekendsday.com
kansasfriedchiken.com
bestselfdrive.com
timeleveragechallenge.com
theunboxiblenation.net
adriaeurope-group.com
acrylicphotobloc.com
theincentivized.com
histreetbutler.com
kumamkt.com
cutepuppyspot.store
crisp-ui.com
easyecotour.com
longshotloungeenglewood.com
esotericclothingco.com
henglai58.com
handmadecircles.com
k9itsrk940aeq6.xyz
service-it-net.com
rt-p-c-14h9-1elk-jpzs.com
Targets
-
-
Target
f02f2961032796a25c7e090bb4f70566_JaffaCakes118
-
Size
252KB
-
MD5
f02f2961032796a25c7e090bb4f70566
-
SHA1
8c530a1533800db7d8dea165ea93421e2c996dad
-
SHA256
7a34064785bd677a927fa90988d9001aed285762f230d0fe08db7b2ca89ce987
-
SHA512
92df5ef56be6a6f5eeaeeb9b11559ca0a2960de9e7e0ba3a24308d603fa7be3375e41f7a618b6d02a4d7739b3ac75ba91203bf2ecfe963689539bc05dcdb0507
-
SSDEEP
6144:Ld53TvpHeIl0l7o0YJvxPfqAg2bwejuDjwZbC9sU7ltYp9f7OANxB:Ld53TvpHeIl0l7ohBv0fAbCHTyqA
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-