General
-
Target
f841c72b1c4cadc4c98903ad26a96a16_JaffaCakes118
-
Size
281KB
-
Sample
240418-sfpw2ahd8w
-
MD5
f841c72b1c4cadc4c98903ad26a96a16
-
SHA1
06359aaf42a5ce60889ab7a93d8af7702b34630a
-
SHA256
eaa038a0020fee7ddfe2919203f20f15ca1d7eb19d90b168cade93b5cf8d7f43
-
SHA512
b80671d608aab3309567326b552a969245e448cd272e635a74abde9082d455e11f9d264928c61647d4b52b183c85425d3933fcffa4093b4453463e295f768f37
-
SSDEEP
6144:wBlL/cQMpuMEI8xf6S6s4SOTJoR6qMdayJ5rSFb1e7uuUI0vVLM:CeQMzEDxf6I8J3dTXuuUbI
Malware Config
Extracted
xloader
2.5
u9xn
lifeguardingcoursenearme.com
bolsaspapelcdmx.com
parsleypkllqu.xyz
68134.online
shopthatlookboutique.com
canlibahisportal.com
oligopoly.city
srchwithus.online
151motors.com
17yue.info
auntmarysnj.com
hanansalman.com
heyunshangcheng.info
doorslamersplus.com
sfcn-dng.com
highvizpeople.com
seoexpertinbangladesh.com
christinegagnonjewellery.com
artifactorie.biz
mre3.net
Targets
-
-
Target
f841c72b1c4cadc4c98903ad26a96a16_JaffaCakes118
-
Size
281KB
-
MD5
f841c72b1c4cadc4c98903ad26a96a16
-
SHA1
06359aaf42a5ce60889ab7a93d8af7702b34630a
-
SHA256
eaa038a0020fee7ddfe2919203f20f15ca1d7eb19d90b168cade93b5cf8d7f43
-
SHA512
b80671d608aab3309567326b552a969245e448cd272e635a74abde9082d455e11f9d264928c61647d4b52b183c85425d3933fcffa4093b4453463e295f768f37
-
SSDEEP
6144:wBlL/cQMpuMEI8xf6S6s4SOTJoR6qMdayJ5rSFb1e7uuUI0vVLM:CeQMzEDxf6I8J3dTXuuUbI
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/xpbpx.dll
-
Size
104KB
-
MD5
4eb0e08649f542fd0e44bef7845956fc
-
SHA1
5fac196ee8af08f8f954f3086c0250a905986c02
-
SHA256
15ed84b6d171b6b6834aa6a39150b6165b2c83411929a8c6963b6e446df44ed1
-
SHA512
de809b359ccd7b65b41fd8320a16793c74ae1eecfee3f25d8a9943ca4d2cda675733794ec944e11d62fcd0f6ad9a0bfd7748e74841c68c6796255235b3d0b68f
-
SSDEEP
1536:oJUmgGAYhReTNsu0yGLmQEQoOoLz8I5EgZ2UlH08mAiI3Wklk9ncobUfsQzt2jwM:CUmgGASei2EAPP3xlkrEmP
Score3/10 -