General
-
Target
f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118
-
Size
224KB
-
Sample
240417-rra2ksbg58
-
MD5
f5fa2e043b901e50f0e6e8ad0e4f7074
-
SHA1
221c67c606a3a2e0c5bfa8b57d7c749e29b074d8
-
SHA256
4938b1c8ca1745b33ea6adc31b39e2003646370ec7f52fe1e89af6903a69aaca
-
SHA512
3d779d6b1ee667a27cf124d41397496620920a7e0544f8fe143e2ab6170148f2c9d6a0f05cef2528827cde20d03c99407d06f4e9a39db13bcb8984ab73ce7dd6
-
SSDEEP
3072:vd+7xl60FFPbkGF+7IFNj84EvodYVnHkgZL1P/7aJ3NrXWPsZa4FSUqcUKZrVU:lOhpblSi/I991P/7aTzna4zqaVU
Malware Config
Extracted
xloader
2.3
mabs
joiderqm.com
hyc306.com
ouchplus.asia
abrosnm3.com
hospitalanti-infectives.com
ala-co.com
morrisonltts.net
tradingimpulse.com
invisibleimagination.com
jdjshop.com
huntedby.com
szsgfdzx.com
germfightersusaiowa.com
pahaadpost.com
obrankers.com
plaeralum.com
getfitwithmeministry.com
smartswaploan.com
gypsyjewelrydesigns.com
meetgoodwill.info
Targets
-
-
Target
f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118
-
Size
224KB
-
MD5
f5fa2e043b901e50f0e6e8ad0e4f7074
-
SHA1
221c67c606a3a2e0c5bfa8b57d7c749e29b074d8
-
SHA256
4938b1c8ca1745b33ea6adc31b39e2003646370ec7f52fe1e89af6903a69aaca
-
SHA512
3d779d6b1ee667a27cf124d41397496620920a7e0544f8fe143e2ab6170148f2c9d6a0f05cef2528827cde20d03c99407d06f4e9a39db13bcb8984ab73ce7dd6
-
SSDEEP
3072:vd+7xl60FFPbkGF+7IFNj84EvodYVnHkgZL1P/7aJ3NrXWPsZa4FSUqcUKZrVU:lOhpblSi/I991P/7aTzna4zqaVU
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-