General
-
Target
f9bfc7f212a6cd22360e1490f555fbdd_JaffaCakes118
-
Size
349KB
-
Sample
240419-hpd6sabc95
-
MD5
f9bfc7f212a6cd22360e1490f555fbdd
-
SHA1
24ea648fde606a1ace9716649b9dc2e40ed90b21
-
SHA256
427b6129f42722d768ebf07bcd966939120313f08e3c5b0c857644f6c2a51693
-
SHA512
6da89c186e10f47c664a2c633b22deae1dad36a8eaa8b2c3d1d3c882e13d56c79f6f65eb7d2252c2ed37ac081d23008553867f2a3c37cd98a829434d14e1527b
-
SSDEEP
6144:V4gfheNKl88ef0pNNZ9N2sHjvXIDRqzFQboylBMZ4inoMvXClY:V8Nmqf0ZZPSiEo54ino1C
Malware Config
Extracted
xloader
2.5
ntfs
cast-host.com
sheenwoman.com
cateringpairs.com
butikgamis.com
esd66.com
beautystaze.com
findavetnearme.com
lyketigers.com
nesboutiqe.com
jadeutil.com
survivalfresh.com
realestatebramlett.com
glorynap.com
awards.institute
huangtapps.com
beyondwithyou.com
cryptocustomerhelp.com
plataformasoma.net
lstpark.com
noalareelecionindefinida.com
Targets
-
-
Target
f9bfc7f212a6cd22360e1490f555fbdd_JaffaCakes118
-
Size
349KB
-
MD5
f9bfc7f212a6cd22360e1490f555fbdd
-
SHA1
24ea648fde606a1ace9716649b9dc2e40ed90b21
-
SHA256
427b6129f42722d768ebf07bcd966939120313f08e3c5b0c857644f6c2a51693
-
SHA512
6da89c186e10f47c664a2c633b22deae1dad36a8eaa8b2c3d1d3c882e13d56c79f6f65eb7d2252c2ed37ac081d23008553867f2a3c37cd98a829434d14e1527b
-
SSDEEP
6144:V4gfheNKl88ef0pNNZ9N2sHjvXIDRqzFQboylBMZ4inoMvXClY:V8Nmqf0ZZPSiEo54ino1C
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-