General
-
Target
fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118
-
Size
885KB
-
Sample
240420-3tbxfadf7x
-
MD5
fdefb10ff2bb3ab90dd75cca967e31cf
-
SHA1
909d8032fcca825c3d76743236bcd569c734624b
-
SHA256
c3dad4eb294afef3dd4251826c1c1d25679c1044120e8bfaaea14e582be06357
-
SHA512
d517c53f2b95d1140b385eddf0c34c973ed79e7fc71100943a05130b8ba0ccd6213864bcf938f7ff83c2aed8a1c9168bf9a775d1c13b3490b7d591e47835bdca
-
SSDEEP
12288:wlDc9F3nC0Py3gAh5F/O1sZpouildw4dy33uFfRoSLu4AgDvXmCGhj2ncpI40E71:whxShldzy33+zLxvXmIK7qPiz5
Malware Config
Extracted
xloader
2.3
n58i
nl-cafe.com
votetedjaleta.com
britrobertsrealtor.com
globipark.com
citysucces.com
verisignwebsite-verified.com
riddlepc.com
rosecityclimbing.com
oleandrinextract.com
salmankonstruksi.com
needhamchannel.com
refreshx2z.com
youth66.com
pla-russia.com
halloweenmaskpro.com
exdysis.com
1gcz.com
lookgoodman.com
rlxagva.com
stlcityc.com
Targets
-
-
Target
fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118
-
Size
885KB
-
MD5
fdefb10ff2bb3ab90dd75cca967e31cf
-
SHA1
909d8032fcca825c3d76743236bcd569c734624b
-
SHA256
c3dad4eb294afef3dd4251826c1c1d25679c1044120e8bfaaea14e582be06357
-
SHA512
d517c53f2b95d1140b385eddf0c34c973ed79e7fc71100943a05130b8ba0ccd6213864bcf938f7ff83c2aed8a1c9168bf9a775d1c13b3490b7d591e47835bdca
-
SSDEEP
12288:wlDc9F3nC0Py3gAh5F/O1sZpouildw4dy33uFfRoSLu4AgDvXmCGhj2ncpI40E71:whxShldzy33+zLxvXmIK7qPiz5
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-