General
-
Target
f79654707fe61191d989632e924e8e1c_JaffaCakes118
-
Size
714KB
-
Sample
240418-jxsjtafe64
-
MD5
f79654707fe61191d989632e924e8e1c
-
SHA1
3541efce30801d58bcf6fd1f17b3e6dea7683fd5
-
SHA256
c01319e969a567a2494e73bfb5179f75a9dc6a0bfb7e0ac56250dc90a72e8959
-
SHA512
adfd67b6f3784e08c1465629f0345517c62196c4420424ac0a0ef6a66fc5487946925d254df7f3f373953e4d6a9b74c941253256feb34e5521a85e7d9f612a47
-
SSDEEP
12288:hS+2IG6xzw7Swi1GqPBHz2IyRjqbfIE/BDBrAbwpzNJjLzU4jxu6LJmVmQ9Bqj27:f2IGXSzNHaVRjU5uezX4Ixu6LkQQhRZl
Malware Config
Extracted
xloader
2.3
usur
purpopup.com
mrswarrenspodcast.com
blinbins.com
parahomeoffice.com
20next.com
quiala.com
newccosecurity.net
throughthehagstone.com
hnxslawfirm.com
sztoium.icu
fullembodiedwoman.com
sankara-yoga.com
foottrafficcollective.com
acruxvacations.com
jadeena.com
neurotypicalspouse.com
onlyinwallkill.com
laurenkilbane.com
thebendavonte.com
regencydevelopmentstoronto.com
Targets
-
-
Target
243d713a5124eb1bb3b1ee2e70c7a404d531da84c68bbfa5a838b092a1058a7a
-
Size
1.1MB
-
MD5
f9bc884d392b1cf3476d36733d443bea
-
SHA1
0355cac4a25abc48cc625b2da9187e7f0d1e5574
-
SHA256
243d713a5124eb1bb3b1ee2e70c7a404d531da84c68bbfa5a838b092a1058a7a
-
SHA512
b59affcf56c37f8837ffe1009eda97ae871bed924c83526ddf139dc6ddce304f56ebc4df4dee2d01dfc09147eff1c8cef5692ce331e5ba49349e4fb9e9edaf48
-
SSDEEP
24576:JYXKi8Tg5e4Nkva4tZxXw4icnnmPHZYD5F3Kd8:JYXKi8Tee64tp7mhYj3Ke
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-