General

  • Target

    fd45ab42cffc17209261bff2430c8245_JaffaCakes118

  • Size

    821KB

  • Sample

    240420-v8psvadh23

  • MD5

    fd45ab42cffc17209261bff2430c8245

  • SHA1

    d06143966b8ca02db582f5111fc275844796786f

  • SHA256

    6afa5e287f69f392b8481a94ebb1729c606a1f1023820e79e942ad40dfe96859

  • SHA512

    c6326b0d3f029bfe7b9d2cee32b89dee3b46b921af5f342958971d5c5be4e2be6fd9d3ca518b5215f6f0a3572d4f739922f1f7392c67acd1967c42d99145252f

  • SSDEEP

    12288:vMrP7wwt12QLaX3miWy4hTniOHDA4HnIsNGEG9gfy27ONd+5nDCZ+ug3vI4SeZ91:ErP7ww4V4h2wChgfVu8q7mo5oFCEkv

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

m6b5

Decoy

ixtarbelize.com

pheamal.com

daiyncc.com

staydoubted.com

laagerlitigation.club

sukrantastansakarya.com

esupport.ltd

vetscontracting.net

themuslimlife.coach

salmanairs.com

somatictherapyservices.com

lastminuteminister.com

comunicarbuenosaires.com

kazuya.tech

insightlyservicedev.com

redevelopment38subhashnagar.com

thefutureinvestor.com

simplysu.com

lagu45.com

livingstonpistolpermit.com

Targets

    • Target

      fd45ab42cffc17209261bff2430c8245_JaffaCakes118

    • Size

      821KB

    • MD5

      fd45ab42cffc17209261bff2430c8245

    • SHA1

      d06143966b8ca02db582f5111fc275844796786f

    • SHA256

      6afa5e287f69f392b8481a94ebb1729c606a1f1023820e79e942ad40dfe96859

    • SHA512

      c6326b0d3f029bfe7b9d2cee32b89dee3b46b921af5f342958971d5c5be4e2be6fd9d3ca518b5215f6f0a3572d4f739922f1f7392c67acd1967c42d99145252f

    • SSDEEP

      12288:vMrP7wwt12QLaX3miWy4hTniOHDA4HnIsNGEG9gfy27ONd+5nDCZ+ug3vI4SeZ91:ErP7ww4V4h2wChgfVu8q7mo5oFCEkv

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Xloader payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks