General
-
Target
f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118
-
Size
229KB
-
Sample
240416-1rvknafb4w
-
MD5
f4689766d507f4eb2f206cf8ea3e237d
-
SHA1
d85b7cf1d1544fb02c50f0ae8fdf24e85adb86b5
-
SHA256
2ab54e46be8e8a1b7e66be9bed5492e2cb5c4112e548442e209954affc2dc374
-
SHA512
606a0e1e61f15785d1f8e411795b11c0e8d20c889a6fdc6c2db445f7e24c9ac8ef50773f91ec76d21ff0b692c208831153254035af947374ec4034d33a50c53e
-
SSDEEP
6144:JwX/EDsssssssssssssvxx02JKflFxLav6qGJyogGzssG5O5POJKf:J4/EDsssssssssssssJ7YtF9eGO6ssGa
Malware Config
Extracted
xloader
2.3
b6cu
votreconseilfinancier.com
wholesaleplay.com
komfy.store
hsyunfan.com
tournamenttips.com
yourbusine.xyz
wrg-referrals.com
harmless-oily.com
whizdomtowealth.com
xusmods.com
cleanerstoday.com
finopscert.com
paerexpress.com
kankb.com
res-o.info
balonpantolon.com
freedownloadbiz.info
jeffegriffin.com
gobahis119.com
ourcalvinsarm.com
Targets
-
-
Target
f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118
-
Size
229KB
-
MD5
f4689766d507f4eb2f206cf8ea3e237d
-
SHA1
d85b7cf1d1544fb02c50f0ae8fdf24e85adb86b5
-
SHA256
2ab54e46be8e8a1b7e66be9bed5492e2cb5c4112e548442e209954affc2dc374
-
SHA512
606a0e1e61f15785d1f8e411795b11c0e8d20c889a6fdc6c2db445f7e24c9ac8ef50773f91ec76d21ff0b692c208831153254035af947374ec4034d33a50c53e
-
SSDEEP
6144:JwX/EDsssssssssssssvxx02JKflFxLav6qGJyogGzssG5O5POJKf:J4/EDsssssssssssssJ7YtF9eGO6ssGa
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-