General
-
Target
JaffaCakes118_5ee7205f9115eb819766e96daecbe33d
-
Size
351KB
-
Sample
250107-m16sdsznck
-
MD5
5ee7205f9115eb819766e96daecbe33d
-
SHA1
08b276da155ba0b394f0a469c4c71acb44ff9a2c
-
SHA256
fbdaffb649cccdfcd50d9b6d0332d6039a065fcc0c08d1f94da828ed3454e2be
-
SHA512
04f79df0dd0b49e86fca8845bd42ef6d55a53fe74f643d0b47b92633cadda7b62658ca2867c27fa026f7ba596ba617be3f279168722d5c6e4b413457493adfac
-
SSDEEP
6144:5ei2R2IMkhBLcZzDmAtte2gxLOTyJsqsffCpUm4v/HqoCXFwfViduVpPuT:JjSBw9he20idqsffr1vvqowGiduVpWT
Malware Config
Extracted
xloader
2.5
bs8f
vasilnikov.com
parkate.club
pol360.com
handmadequatang.com
consult-set.com
nourkoki.com
theveganfusspot.com
dreamssail.com
pinpinyouqian.xyz
satellitphonestore.com
yotosunny.com
telosaolympics.com
gogetemm.com
yozotnpasumo2.xyz
avantgardemarket.com
glenndcp.com
dirtydriverz.com
avaui.com
anchoredtheblog.com
marianaoliveiraarquitetura.com
Targets
-
-
Target
JaffaCakes118_5ee7205f9115eb819766e96daecbe33d
-
Size
351KB
-
MD5
5ee7205f9115eb819766e96daecbe33d
-
SHA1
08b276da155ba0b394f0a469c4c71acb44ff9a2c
-
SHA256
fbdaffb649cccdfcd50d9b6d0332d6039a065fcc0c08d1f94da828ed3454e2be
-
SHA512
04f79df0dd0b49e86fca8845bd42ef6d55a53fe74f643d0b47b92633cadda7b62658ca2867c27fa026f7ba596ba617be3f279168722d5c6e4b413457493adfac
-
SSDEEP
6144:5ei2R2IMkhBLcZzDmAtte2gxLOTyJsqsffCpUm4v/HqoCXFwfViduVpPuT:JjSBw9he20idqsffr1vvqowGiduVpWT
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
Xloader payload
-
Suspicious use of SetThreadContext
-