General
-
Target
544ece457e19d0f63969651b6a61aa49_JaffaCakes118
-
Size
416KB
-
Sample
240518-mw5drsfh25
-
MD5
544ece457e19d0f63969651b6a61aa49
-
SHA1
f7564ce804a93ee22d38669a611266eba0449878
-
SHA256
4761bbde870190a51ffa8598c442af5b834476c02839626eebc85fc21eb94c17
-
SHA512
0d7ecf3945d798cb577b56e8c5dad906207e484889761e1671a93d1c9b0995897faf8d9058e3e53c4c849a0c019fedf5330317d443ec2d4fbcc7dbac92deb3ea
-
SSDEEP
12288:zE+nOoXmJLVdEtCDpz3Vw4qOJg8RlKQtSV1Hm:zEJVdEtCDpz3VO4rPKQtSHHm
Malware Config
Extracted
xloader
2.1
ggb4
page-helpdesk-submit37950.com
deathmedical.com
cr20business.com
4469783.com
shoesupweb.com
magallanes.xyz
mayfairfestival.com
obezzarazhivanie-vozduha.pro
discountsstore.store
globejetflights.com
coffeeonestop.com
telemedottawa.com
southwestcri.com
laowuts.com
menwa.online
upintothegame.com
pennypinchersinc.com
luchamosporustednj.com
thirdistheword.com
adonmarket.com
Targets
-
-
Target
544ece457e19d0f63969651b6a61aa49_JaffaCakes118
-
Size
416KB
-
MD5
544ece457e19d0f63969651b6a61aa49
-
SHA1
f7564ce804a93ee22d38669a611266eba0449878
-
SHA256
4761bbde870190a51ffa8598c442af5b834476c02839626eebc85fc21eb94c17
-
SHA512
0d7ecf3945d798cb577b56e8c5dad906207e484889761e1671a93d1c9b0995897faf8d9058e3e53c4c849a0c019fedf5330317d443ec2d4fbcc7dbac92deb3ea
-
SSDEEP
12288:zE+nOoXmJLVdEtCDpz3Vw4qOJg8RlKQtSV1Hm:zEJVdEtCDpz3VO4rPKQtSHHm
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-