General
-
Target
5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118
-
Size
2.4MB
-
Sample
240719-d8yx3svanf
-
MD5
5a53f07640f66b7e88ac3d0b4acd5f9a
-
SHA1
f8fbe7bbf85d97e557257c9fe09414a804da4a36
-
SHA256
842898cfb97f8c01b55ea1aaf32ffffb5497e1dbe6ea309bfa715e37212bb6da
-
SHA512
c0de15838eb3f87f0846f6c132db4e7c31630092d8af1552eac89a9f10cba3fd06373e0768f7504814c9728716ceaa9623db151a0b7f41354bd23c5d32b61242
-
SSDEEP
49152:uooZ0ajbQzlq5O+l4QOnn8jeX+l8uvlhfNf5lWLPNyeL9+hw/USGy7Xk/51HwgGQ:eX0zlC6mJ98BVF/Q1a7
Malware Config
Extracted
xloader
2.3
u2km
fairhygiene.com
adminnovicepro.xyz
mysteptofreedom.com
beachstoreonline.com
outofmyfacemace.com
jjudit.com
x-box2send22.club
genuineconsultingservices.com
avreeaylwomackoneil.online
englandisrael.com
wealthwelb.com
ettransfertest.com
digitalrealestate.computer
aryamansaigoa.com
caterinebat.com
bostonm.info
n1nte.net
newvisiontravels.com
ma-apo.com
samrcaldwell.net
Targets
-
-
Target
5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118
-
Size
2.4MB
-
MD5
5a53f07640f66b7e88ac3d0b4acd5f9a
-
SHA1
f8fbe7bbf85d97e557257c9fe09414a804da4a36
-
SHA256
842898cfb97f8c01b55ea1aaf32ffffb5497e1dbe6ea309bfa715e37212bb6da
-
SHA512
c0de15838eb3f87f0846f6c132db4e7c31630092d8af1552eac89a9f10cba3fd06373e0768f7504814c9728716ceaa9623db151a0b7f41354bd23c5d32b61242
-
SSDEEP
49152:uooZ0ajbQzlq5O+l4QOnn8jeX+l8uvlhfNf5lWLPNyeL9+hw/USGy7Xk/51HwgGQ:eX0zlC6mJ98BVF/Q1a7
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Beds Protector Packer
Detects Beds Protector packer used to load .NET malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-