General
-
Target
fdb8b9c8056a552461e493d3f1b4b2d8_JaffaCakes118
-
Size
253KB
-
Sample
240420-1n3rvsbd51
-
MD5
fdb8b9c8056a552461e493d3f1b4b2d8
-
SHA1
87ea5998b4f6831c99bdce8cd48d3c238833d2c7
-
SHA256
e33f9dbf56b2850d44ff3f6dff7b0631abbc52836b97cc41c4e4907538ed749a
-
SHA512
59217111d51a555867dac4df8e3e609706d671d1802f8c70daad3f913965dcb10cca6d878a3963e1aff7527628c7392de6b95fbf72564227a1d0b8ddea99a1b9
-
SSDEEP
6144:bd53TvpHeIl0SQCoocCvKrcIxJYAsXfpuUVbbNGw411hwpXHRqjoEt60R0bAM:bd53TvpHeIl0SVoA83YAAuUV/AHhQgPu
Malware Config
Extracted
xloader
2.3
um8e
theypretend.com
hopeschildren.com
kuly.cloud
maniflexx.net
bedtimesocietyblog.com
spenglerwetlandpreserve.com
unity-play.net
bonap56.com
consciencevc.com
deluxeluxe.com
officialjuliep.com
cttrade.club
quietflyt.com
mcabspl.com
lippocaritahotel.com
tolanfilms.xyz
momenaagro.com
slingshotart.com
thefoundershuddle.com
mobilbaris.com
Targets
-
-
Target
fdb8b9c8056a552461e493d3f1b4b2d8_JaffaCakes118
-
Size
253KB
-
MD5
fdb8b9c8056a552461e493d3f1b4b2d8
-
SHA1
87ea5998b4f6831c99bdce8cd48d3c238833d2c7
-
SHA256
e33f9dbf56b2850d44ff3f6dff7b0631abbc52836b97cc41c4e4907538ed749a
-
SHA512
59217111d51a555867dac4df8e3e609706d671d1802f8c70daad3f913965dcb10cca6d878a3963e1aff7527628c7392de6b95fbf72564227a1d0b8ddea99a1b9
-
SSDEEP
6144:bd53TvpHeIl0SQCoocCvKrcIxJYAsXfpuUVbbNGw411hwpXHRqjoEt60R0bAM:bd53TvpHeIl0SVoA83YAAuUV/AHhQgPu
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-