General
-
Target
f5e7bf270b60cd8a71fc8be79ea7aae4_JaffaCakes118
-
Size
298KB
-
Sample
240417-qy28zaaa62
-
MD5
f5e7bf270b60cd8a71fc8be79ea7aae4
-
SHA1
e9361f22d9b0a2aba641b9cedbaa203ac32e30c6
-
SHA256
88a982fd729f861a4439a59e632a7d76eb033991c437a2368bc2a834873f1f8a
-
SHA512
cea75189109aab37974c7f57b7008c18755e362658ef47cfc093708fbe8b8ef06383458f898ebf11b1359b334980a70d18604a79265176d4773c3dfdfe4ab097
-
SSDEEP
6144:jCeJW1DhGOWLpoLuVLhiade0Huq8PGMZW/d+2t7i+:/WJhGOWLpogLAa40+PGMZHe7l
Malware Config
Extracted
xloader
2.3
pagi
makehrworkable.com
sound-wisdom.com
blacts.com
caenantglamping.com
meridiancpas.com
draughtedinn.co.uk
windywoodshc.com
mintmovileplus.com
pubgeventdailylogin.com
thesocialdzr.com
holapv.com
racevc.com
openpula.pro
wepreventstroke.com
autoclosy.com
enginkarabacak.com
15096eec1652.info
buildthefoundation.net
pwilliamberciklaw.com
paramountrevenueadvisors.com
Targets
-
-
Target
f5e7bf270b60cd8a71fc8be79ea7aae4_JaffaCakes118
-
Size
298KB
-
MD5
f5e7bf270b60cd8a71fc8be79ea7aae4
-
SHA1
e9361f22d9b0a2aba641b9cedbaa203ac32e30c6
-
SHA256
88a982fd729f861a4439a59e632a7d76eb033991c437a2368bc2a834873f1f8a
-
SHA512
cea75189109aab37974c7f57b7008c18755e362658ef47cfc093708fbe8b8ef06383458f898ebf11b1359b334980a70d18604a79265176d4773c3dfdfe4ab097
-
SSDEEP
6144:jCeJW1DhGOWLpoLuVLhiade0Huq8PGMZW/d+2t7i+:/WJhGOWLpogLAa40+PGMZHe7l
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-