General
-
Target
c0a2a0aceaf14e6c168accbd44c6a583_JaffaCakes118
-
Size
679KB
-
Sample
241204-d7kdaszndy
-
MD5
c0a2a0aceaf14e6c168accbd44c6a583
-
SHA1
b97de15dcacda937581b607aff0b65f703cf063a
-
SHA256
f0f020c489ae8bad33cee5f66c276f1a40dd9aff5eff55648922de36da0e233c
-
SHA512
ffe70e0a7cb14a2a0df313da77751dfd760d211097f3d6f966fdeda3ce222c8bd43aae9e77a431370f75ea48770280ebbf446972a8a69532a1315787016583f4
-
SSDEEP
12288:1bQ+X8+UiDLbRHahDU1Q3ZC2csPS2FQzab85LabwSdpmSqYeo+fuDJaKU2of:1bQ+X8+UiDLbRHahDUm3ZC+PTFQ2bkS
Malware Config
Extracted
xloader
2.5
wdc8
qiklanka.com
creativechaos520.com
parentsfuid.com
phenyx.education
raisinglittlejoeys.com
gazalvet.com
xymton.com
yavstore.com
khnfcl.net
amarillodefenseattorney.com
pnsp3.xyz
dolletecarter.com
didong247.net
eaujeunetuesunique.com
ivoireshoping.com
insurancewineappraisals.com
buyidh.xyz
kpfoundationinc.com
glow49.com
discountchristmas.com
Targets
-
-
Target
c0a2a0aceaf14e6c168accbd44c6a583_JaffaCakes118
-
Size
679KB
-
MD5
c0a2a0aceaf14e6c168accbd44c6a583
-
SHA1
b97de15dcacda937581b607aff0b65f703cf063a
-
SHA256
f0f020c489ae8bad33cee5f66c276f1a40dd9aff5eff55648922de36da0e233c
-
SHA512
ffe70e0a7cb14a2a0df313da77751dfd760d211097f3d6f966fdeda3ce222c8bd43aae9e77a431370f75ea48770280ebbf446972a8a69532a1315787016583f4
-
SSDEEP
12288:1bQ+X8+UiDLbRHahDU1Q3ZC2csPS2FQzab85LabwSdpmSqYeo+fuDJaKU2of:1bQ+X8+UiDLbRHahDUm3ZC+PTFQ2bkS
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
Xloader payload
-
Suspicious use of SetThreadContext
-