General
-
Target
4a44628458993a9256535200ac0913ed_JaffaCakes118
-
Size
662KB
-
Sample
241015-17rtpszepe
-
MD5
4a44628458993a9256535200ac0913ed
-
SHA1
b3fc9c3b8932edb27dc48e3a40c3f15e0d22298a
-
SHA256
9ee324f352cb42be67afad04bd0e3ed46521c98a75cb6043e96047137c326911
-
SHA512
06c7c6d1bcf207b5278bccd604df0639ecb8ac3807575b473ce36979a959a45fc93624361872f1d333b8cffbb8eff573f5cdf29fee256010ba6b764cb509fe3c
-
SSDEEP
12288:Qes33Zehe8G0n4uAR+8wwg/psXch+7YyjlymKvnZH4ztbjRGWsuNg:QesH8G97RHwX2csYIy5/ZH41UWsx
Malware Config
Extracted
xloader
2.3
ipa8
royalposhpups.com
univa.world
lanerbo.com
shopbabygo.com
theutahhomestore.com
serialmixer.icu
linfeiya.com
xn--12cg3de5c2eb5cyi.com
am-conseil-communication.com
dailygame168.com
therightmilitia.com
visions-agency.com
mapopi.com
frugallyketo.com
guapandglo.com
54w-x126v.net
your-health-kick.com
blockchainhub360.com
registernowhd.xyz
votekellykitashima.com
Targets
-
-
Target
ZYJY-2021010005.RXHT0021.exe
-
Size
882KB
-
MD5
ce877088e8ee801231a24207267d7beb
-
SHA1
735926def0efdd6123fb5e6dd28b37e81e44fd91
-
SHA256
1f842cf49a031ad6112edf767d3022d47391b39fd3bda6e7c456f5815f8bf742
-
SHA512
20174dcf5a9e6ce2bbcb50c39e50886fe5ee90c915b79a501126d175e12fe75de5f48b90c0dfb5cb3566b2510a8fdb0039a75a7cdd56f672293ecb7a52e9e665
-
SSDEEP
12288:ZSD19TejCYDeeWAHcIActYY6Sr336nWpIQNe6crQbwUfecvxpOZTHK7zVzKboASR:EDDKjv63AkTSb36YIJUf3xprFKboF
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-