General
-
Target
JaffaCakes118_95386352ce2036d3f685512bd70327ff
-
Size
833KB
-
Sample
250108-j62tva1qdy
-
MD5
95386352ce2036d3f685512bd70327ff
-
SHA1
167459c4518f6ec214f0b67f821574f1394435fb
-
SHA256
f2ae44a2f71f141aa0bcf68525a62c53b39de8bcf678335d7fd32fd8a6cf8495
-
SHA512
893ed89f6cf5961f85e4921a98f4f2dd912620a5520b16674e0b48f51e22c8fc9411aab7e26e0ceb7b97ef4eb4a1aa293534731943a51100cd71be5ae450eff7
-
SSDEEP
12288:uU1KRUi2iNmZQcdYI3Nj2G6RTWGlIl4Um0rQ:uU1gUi10l2WCIl4
Malware Config
Extracted
xloader
2.5
a49i
myprobioticspayme.com
shavers.today
cinqueportshealthcare.com
itmservicesincne.com
credit-comparison.com
xn--2kr800ab2z.group
onlinebiyoloji.online
risaki.net
americasgotargument.com
rosinterpro.com
cortadoresdejamon.biz
hotamourclub.art
boettcherlaw.com
nuciic.com
redesdelraco.com
chivang.com
yourkstreetexperience.com
yourwaykeji.com
natureate.com
bidyawasterecycling.com
Targets
-
-
Target
JaffaCakes118_95386352ce2036d3f685512bd70327ff
-
Size
833KB
-
MD5
95386352ce2036d3f685512bd70327ff
-
SHA1
167459c4518f6ec214f0b67f821574f1394435fb
-
SHA256
f2ae44a2f71f141aa0bcf68525a62c53b39de8bcf678335d7fd32fd8a6cf8495
-
SHA512
893ed89f6cf5961f85e4921a98f4f2dd912620a5520b16674e0b48f51e22c8fc9411aab7e26e0ceb7b97ef4eb4a1aa293534731943a51100cd71be5ae450eff7
-
SSDEEP
12288:uU1KRUi2iNmZQcdYI3Nj2G6RTWGlIl4Um0rQ:uU1gUi10l2WCIl4
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
Xloader payload
-
Suspicious use of SetThreadContext
-