General
-
Target
92f1915387c0b517f66702f5111c3405_JaffaCakes118
-
Size
569KB
-
Sample
240813-nznqvswfpr
-
MD5
92f1915387c0b517f66702f5111c3405
-
SHA1
5ff0fdde257826b10ce659b1d8821ec9e2e97a79
-
SHA256
fb45f8100f28c806df3a627ad674e044a98f386691aedb6035b0b6797eeaccc4
-
SHA512
7f9d31b176503c3e9aca12e12640c590ce69226f8d701d42617283325463cff84b33e8d32069a6f602f4cdc38a95cb2e2a558af5bd2e8ab90d000d869369be4d
-
SSDEEP
6144:j9+NMfRXRWR/wwTRVlDTDG/QY4YUBzSajQ+5EsPOF5vRbTq+mT/zF6gGz+q2u0Mo:k1TAQkMzDUwovRbTOTrINz+qpdd8nh5
Malware Config
Extracted
xloader
2.3
qbeg
cssquaredgames.com
photumapps.site
adityachevella.com
rdint.net
aibocapital.com
ehfnmpcv.icu
altanube.com
positivelyunrealclothing.com
thecognitiv.com
kundk-gebaeudemanagement.com
liveatfyi.com
mx-mark.xyz
joyidagiza.com
belledonneforet.com
parent-list.com
andreflorist.com
travelustrentals.com
sreecharithhospitals.com
shotsound.com
handlewithhaircarebeauty.com
Targets
-
-
Target
92f1915387c0b517f66702f5111c3405_JaffaCakes118
-
Size
569KB
-
MD5
92f1915387c0b517f66702f5111c3405
-
SHA1
5ff0fdde257826b10ce659b1d8821ec9e2e97a79
-
SHA256
fb45f8100f28c806df3a627ad674e044a98f386691aedb6035b0b6797eeaccc4
-
SHA512
7f9d31b176503c3e9aca12e12640c590ce69226f8d701d42617283325463cff84b33e8d32069a6f602f4cdc38a95cb2e2a558af5bd2e8ab90d000d869369be4d
-
SSDEEP
6144:j9+NMfRXRWR/wwTRVlDTDG/QY4YUBzSajQ+5EsPOF5vRbTq+mT/zF6gGz+q2u0Mo:k1TAQkMzDUwovRbTOTrINz+qpdd8nh5
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-