General
-
Target
94b756b0c00ca184244fb45ab25b9921_JaffaCakes118
-
Size
243KB
-
Sample
241124-ptzfvawmfn
-
MD5
94b756b0c00ca184244fb45ab25b9921
-
SHA1
7d8210bbfcfa2c3065d970ad107164b1037a4db5
-
SHA256
b325f9c2ac2633700ba7f3d59d90b25b0936738d51da7b68e4465a5245124c27
-
SHA512
03f497db6ee5b187db98f8037d9b54f05a6488ebae67d97fd4639aea2020e844cd9ebd6001a843dfa9d5a10f777161e44a41f1fc086bedba1ea7fa2841011d48
-
SSDEEP
6144:rQPCoON0oMlM9bnTXfZFuE29figIiBDh+NqEBj/J:rgCoO2oMa9brRFGaHioNqEBj/J
Malware Config
Extracted
xloader
2.3
usvr
theblockmeatstore.com
drone-moment.com
srsfashionbd.com
kylayagerartwork.com
instagrams.tools
rosenwealth.com
indicraftsvilla.com
rswizard.com
irist.one
pubgclaimx14.com
thegeorgiahomefinder.com
unusualdog.com
kifayatikart.com
methodunit.net
bavarian-luxury.com
17391000.com
ipcsaveday.com
yael-b.com
pasionqueconecta.com
youngsvideography.com
Targets
-
-
Target
INVOICE_90990_PDF.exe
-
Size
297KB
-
MD5
3e94bee073a286e8b446e87a126dde1e
-
SHA1
bf461d7bc78fd36eb06ca49e4e02c3bc06897905
-
SHA256
85951f6ce24ad0c5e5a73c26b48dca2c9e013b554639e46dbf02bffd56cf1891
-
SHA512
62f69bdcf76a8d03be76fbc3f9e92690dac88b5bcebb127b0ccf1c5fee63d7c3a22bcf49810ae7294aa2828618e0403a7cc5e61e5b6b492f3704b9e2b456e2a1
-
SSDEEP
6144:K88JIphcJQgx6nTM0qnI9SIBxbJUvGlTcVvwKEEtWm4O2e1:j8JvJQ7Q3ISwxbJSGlTmEky+
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
Xloader payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-