General
-
Target
f8974c98f35979dc47ef297300216205_JaffaCakes118
-
Size
622KB
-
Sample
240418-x1jyqsce69
-
MD5
f8974c98f35979dc47ef297300216205
-
SHA1
be26ae3b322488ae20218930ad7170095933a89b
-
SHA256
9a70c87569365146a5ae6d0d933c54e53784f268ed764285e2df61691864249a
-
SHA512
143733ce8d783d865d15029730b828947043e053dcf5380a380a307117d977b05b663cdde903621119fad5619044970ef6004f7946a60d9bf6c617534d99f81b
-
SSDEEP
12288:6ylhn6MtWV/pTvpskt1o1t+BPQG5OxcLuzeSAn85rx/eAjh:BHn6M8VxBwjA4tzKQxNV
Malware Config
Extracted
xloader
2.3
m7gs
goodxxxhigh.com
blun33.com
mcbt328.com
sxtdba.com
sagalocal.icu
spentonindustries.com
greatexpectationssouthshore.com
herzenco.com
duoxizhe.com
h-mawari.net
jeevicain.com
sculpted-vegan.net
vipchainwallet.com
smartanalytics.info
jiujirat.com
canhoquan8-centralpremium.com
pasarandir.com
mario17331.com
dillonsavage.com
ladiesboxx.com
Targets
-
-
Target
Quotation 85663455.exe
-
Size
769KB
-
MD5
78a48c9ca7cb69737740772bfbff1db7
-
SHA1
2079cb5fc6559e71f264144c92132a5a4e174962
-
SHA256
64550a0d3d1c28b1ec50006327a707b7287997aa7ca146153440935a033ccb97
-
SHA512
710356de5059511b606a553675427b905822bc8ee19bfec3d2ad903d1c22265f69273ab59e5b27d092bac088719de43e61ebd2ed67ccb426bdc9eea02eddc971
-
SSDEEP
12288:2ToRXAGxYR+PMnf2EKXNzo/Yvf3CJDvrHzuaImz1NZ1eCiHUQhnmw2o5f5JOEPpQ:AoRXcRH2XzgYvvCpzXIwLiFnl2IRHPi
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-