General
-
Target
f34eea6b9339b34712379c05e1f279bf_JaffaCakes118
-
Size
484KB
-
Sample
240416-mmkm1aab3t
-
MD5
f34eea6b9339b34712379c05e1f279bf
-
SHA1
13ff68a530c3147f9208b2297e226047ab8b9c61
-
SHA256
4505184d5c4f87281fa5ddf2f6581885983b435e56bf7bbbdd6bc97e6accb70d
-
SHA512
de7ada96b4e30a19d704d6b07a0a2e8ac4e57413dcf48eaa0c02a733fe152a83034b2f605b6a3884fa1f49d8afc42fbdc959f9c7e8800eccc26d830319cde2e4
-
SSDEEP
12288:GsZNaRYGHi4DGjIH35y6aLqzINZUkrll/q6P27L/gGGWmxiQwnPw6sCyCD6IFBQ:BJL0aFJ1A2TaM+
Malware Config
Extracted
xloader
2.5
gab8
amateurfeetworship.com
big-food.biz
metaversevolution.com
profecional-pacasmayo.com
royzoom.com
bekindevolution.com
hokozaki.com
waltersswholesale.com
wayfinderacu.com
schnurrgallery.com
babygearrentals.net
imggtoken.club
24x7x366.com
lakiernictwo.info
les-cours.com
dwticket.com
onarollshades.com
ramireztradepartners.com
safarparfums.com
6ngie.info
Targets
-
-
Target
f34eea6b9339b34712379c05e1f279bf_JaffaCakes118
-
Size
484KB
-
MD5
f34eea6b9339b34712379c05e1f279bf
-
SHA1
13ff68a530c3147f9208b2297e226047ab8b9c61
-
SHA256
4505184d5c4f87281fa5ddf2f6581885983b435e56bf7bbbdd6bc97e6accb70d
-
SHA512
de7ada96b4e30a19d704d6b07a0a2e8ac4e57413dcf48eaa0c02a733fe152a83034b2f605b6a3884fa1f49d8afc42fbdc959f9c7e8800eccc26d830319cde2e4
-
SSDEEP
12288:GsZNaRYGHi4DGjIH35y6aLqzINZUkrll/q6P27L/gGGWmxiQwnPw6sCyCD6IFBQ:BJL0aFJ1A2TaM+
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-