General
-
Target
f5e06eac210ad2965522d958281c8c95_JaffaCakes118
-
Size
733KB
-
Sample
240417-qpaglaah8w
-
MD5
f5e06eac210ad2965522d958281c8c95
-
SHA1
102aa3b2f0a0f032fd4f830095617674be963525
-
SHA256
94ec59e8f70de9f2fc9a4774fc7ed32a7a0495115a813537f77c9aeb505a5bc4
-
SHA512
3e7657b45fdd015d966c78e17af01cf204a6886b951cb66960effbf8b35dec2e5927eb88f71cd272d27ce8e1f7ab9949293ecf0091747b9ba9a4970a33cdce91
-
SSDEEP
12288:yX2fYp/cCOsBgo0q4wMRYSyKDpbeE9/fJT8c0TXH/wOKviT:yX2fzCOsBgo0q4wMRYzKFHHJTwrHrj
Malware Config
Extracted
xloader
2.3
wufn
rsautoluxe.com
theroseofsharonsalon.com
singnema.com
nathanielwhite108.com
theforumonline.com
iqpt.info
joneshondaservice.com
fafene.com
solanohomebuyerclass.com
zwq.xyz
searchlakeconroehomes.com
briative.com
frystmor.city
systemofyouth.com
sctsmney.com
tv-safetrading.com
thesweetboy.com
occulusblu.com
pawsthemomentpetphotography.com
travelstipsguide.com
Targets
-
-
Target
f5e06eac210ad2965522d958281c8c95_JaffaCakes118
-
Size
733KB
-
MD5
f5e06eac210ad2965522d958281c8c95
-
SHA1
102aa3b2f0a0f032fd4f830095617674be963525
-
SHA256
94ec59e8f70de9f2fc9a4774fc7ed32a7a0495115a813537f77c9aeb505a5bc4
-
SHA512
3e7657b45fdd015d966c78e17af01cf204a6886b951cb66960effbf8b35dec2e5927eb88f71cd272d27ce8e1f7ab9949293ecf0091747b9ba9a4970a33cdce91
-
SSDEEP
12288:yX2fYp/cCOsBgo0q4wMRYSyKDpbeE9/fJT8c0TXH/wOKviT:yX2fzCOsBgo0q4wMRYzKFHHJTwrHrj
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Xloader payload
-
Suspicious use of SetThreadContext
-