General
-
Target
f0ed2e7cf6f9f1d1c50685e851a06412_JaffaCakes118
-
Size
387KB
-
Sample
240415-nczjvafd2z
-
MD5
f0ed2e7cf6f9f1d1c50685e851a06412
-
SHA1
3d0949bc857db236e56c495d6a570e54bd09d6c8
-
SHA256
ed97e9802edd407c13fe0fa214582d2c4623797bb0c38b0b583a1d919d078284
-
SHA512
23141f5ab73b9ced48e51a77b57dc3d5eb37ae23d768addf326b22ffdef7b01118746728643fe267071c6863a04a6a72c2937998d40efa7cdfb84c3a918535cf
-
SSDEEP
12288:/fiNDGoVZvUiJo7uhXDR7D+d7to2wk6EfLg:S1xJo6hTR7DSxo236f
Malware Config
Extracted
xloader
2.3
qmf6
triloxi.com
blackstogether.com
jctradingllc.com
debbieandlesa.com
badseedsco.com
tjlovers.com
creativeresourcesconsulting.com
ksmjobs.net
reginajohas.net
site123web.com
pracliphardware.com
lunchtimewithtwilyght.com
remotereel.com
spartanmu.com
porter-booking-engine.com
slouberdounces.com
certificationsarchive.com
kat420nip.com
prancegoldholdingsjewels.com
xn--botiqunbotnico-4gb1q.com
Targets
-
-
Target
f0ed2e7cf6f9f1d1c50685e851a06412_JaffaCakes118
-
Size
387KB
-
MD5
f0ed2e7cf6f9f1d1c50685e851a06412
-
SHA1
3d0949bc857db236e56c495d6a570e54bd09d6c8
-
SHA256
ed97e9802edd407c13fe0fa214582d2c4623797bb0c38b0b583a1d919d078284
-
SHA512
23141f5ab73b9ced48e51a77b57dc3d5eb37ae23d768addf326b22ffdef7b01118746728643fe267071c6863a04a6a72c2937998d40efa7cdfb84c3a918535cf
-
SSDEEP
12288:/fiNDGoVZvUiJo7uhXDR7D+d7to2wk6EfLg:S1xJo6hTR7DSxo236f
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-