General
-
Target
fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118
-
Size
688KB
-
Sample
240420-z4kqjsab43
-
MD5
fdaa7ea645b190b5049db5e11ee65456
-
SHA1
c96956ef38e91160217379b008b4534d5c7862c6
-
SHA256
e94ab3e9bc6dfb0889e82075cbef674de3c160a8d4bbf9b3d596381bebf492af
-
SHA512
95cb0f1614d065db83e7ac94f9fb3587f02d72118ce2b91e7480eb801b484acca64a388eb1e2c944abdc069698d4e888307c1a2d534bfae1fd903d34a577ef9f
-
SSDEEP
12288:DeZh7/duQkE35lyl9JTY7lVWrMQ4ZwCFaGZS2m:D8dZ5le87zWoQ4ZlaGZy
Malware Config
Extracted
xloader
2.3
mej0
mtxs8.com
quickskiplondon.com
sltplanner.com
generatedate.com
amsinspections.com
tomrings.com
109friends.com
freelovereading.com
avalapartners.com
nordiqueluxury.com
inmbex.com
everybankatm.com
bo1899.com
ashymeadow.com
pubgm-chickendinner.com
takudolunch.com
carlagremiao.com
actonetheatre.com
wemhealth.com
khasomat.net
Targets
-
-
Target
fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118
-
Size
688KB
-
MD5
fdaa7ea645b190b5049db5e11ee65456
-
SHA1
c96956ef38e91160217379b008b4534d5c7862c6
-
SHA256
e94ab3e9bc6dfb0889e82075cbef674de3c160a8d4bbf9b3d596381bebf492af
-
SHA512
95cb0f1614d065db83e7ac94f9fb3587f02d72118ce2b91e7480eb801b484acca64a388eb1e2c944abdc069698d4e888307c1a2d534bfae1fd903d34a577ef9f
-
SSDEEP
12288:DeZh7/duQkE35lyl9JTY7lVWrMQ4ZwCFaGZS2m:D8dZ5le87zWoQ4ZlaGZy
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-