General
-
Target
721bf6a91be5db21e3d1117d616e3cf1_JaffaCakes118
-
Size
360KB
-
Sample
240726-b4jaqa1gjg
-
MD5
721bf6a91be5db21e3d1117d616e3cf1
-
SHA1
65137a20beffcf97e5c1043899a34a6622d9d900
-
SHA256
b82445ea47014ab695f0ddc26fd05cdaab25699412c3850c793dea1d64ac711e
-
SHA512
c492dc1bd8d2f46dd957f1d4465c663d087d257c1cd6aedd5aa06c8d8b61997948b9d19375ceb05779141144def85214beec362726fb25df07fc6f4df9d5203b
-
SSDEEP
6144:580LH7Hw32RRcBTBs5i65lOXWSQsZCwBi4zP1dEeegf9ycJIZw6T4:580/HwSidqU65lOXVQsZCwBi4jcK90up
Malware Config
Extracted
xloader
2.3
uidr
dulichsongcham.com
cash-royal.com
geneseewildlifetrapping.com
9cc9x79m3y2.com
ntjjzx.com
joinglooko.com
upmchealhtrak.com
hookandcask.com
orca-web.com
ag3holdings.com
empoweredinvestmentstx.com
lustywall.com
rcpelaurentides.com
goyalcoorchidnirvanatwo.homes
iotajinn.com
littlemlive.com
hippocratesbio.com
ashleysema.design
175a45.xyz
bpocompaniesphilippines.com
Targets
-
-
Target
Quotation.exe
-
Size
478KB
-
MD5
085f6796a761a1f1dd252ef348f2fe69
-
SHA1
9abd15c6bc542b0bd8baa79f90540dd7f1f80af1
-
SHA256
b0787f51caf44390126cfb1e827d548139021e30bca2cf2e299917ea5788a8bf
-
SHA512
80ca49f471e3b53890869e4be0cfae82ce12367ce20b5436a5daa8c886f7e14f11b2de402ae714f53ac362b730a1fb104d981e99ab186b795e24ae8da4d2131f
-
SSDEEP
12288:Xd9ozJLSibqU65lOAVQsuCwBivjcK95u1t09b:LozlSDUiVQsVaIF
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-