General
-
Target
f826defd978e74a09d47ad5cbe2a6c93_JaffaCakes118
-
Size
347KB
-
Sample
240418-rcf92sgb9w
-
MD5
f826defd978e74a09d47ad5cbe2a6c93
-
SHA1
6892b6ebc8301ac535af2391aa0563453082fa4f
-
SHA256
2aa4e557d70c43b63c4c83dae89a00b09ded7c16317a30cce69d8b44c4ae2c2d
-
SHA512
44f3e9d07b4b520a5004c11ff903fa2868a423d062fc5f18c7faf0b45343d593db75a36b4585729b95488616a490af1facb66ad98a2d5f061b78021ba9f1c811
-
SSDEEP
6144:pF49qqKGPBcwqh3SBYA4444444444444BffIq2DPzY1vPT+hn7kg46meJl+Ku:pzvGPOEYdfvEzY56kumeJl+x
Malware Config
Extracted
xloader
2.3
b6a4
reviewsresolutions.com
binhminhgardenshophouse.com
nebulacom.com
kadhambaristudio.com
viltoom.club
supmomma.com
tjszxddc.com
darlingmemories.com
hyperultrapure.com
vibembrio.com
reallycoolmask.com
cumbukita.com
brian-newby.com
abstractaccessories.com
marykinky.com
minnesotareversemtgloans.com
prasetlement.com
xplpgi.com
xn--gdask-y7a.com
uababaseball.com
Targets
-
-
Target
f826defd978e74a09d47ad5cbe2a6c93_JaffaCakes118
-
Size
347KB
-
MD5
f826defd978e74a09d47ad5cbe2a6c93
-
SHA1
6892b6ebc8301ac535af2391aa0563453082fa4f
-
SHA256
2aa4e557d70c43b63c4c83dae89a00b09ded7c16317a30cce69d8b44c4ae2c2d
-
SHA512
44f3e9d07b4b520a5004c11ff903fa2868a423d062fc5f18c7faf0b45343d593db75a36b4585729b95488616a490af1facb66ad98a2d5f061b78021ba9f1c811
-
SSDEEP
6144:pF49qqKGPBcwqh3SBYA4444444444444BffIq2DPzY1vPT+hn7kg46meJl+Ku:pzvGPOEYdfvEzY56kumeJl+x
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-