General
-
Target
fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118
-
Size
1.2MB
-
Sample
240421-cr862sge75
-
MD5
fe346737f236e64f7b1f0120cf4fd261
-
SHA1
6901215d58e95a7bf12c0507c528f77d1c6329a4
-
SHA256
9be04bb6af5b7e9fe3073b948c345eee2491d61c985997d681ea253c7b62aa4c
-
SHA512
4753b08ebf22f06c31d1123fbdec5578d3b57805af512ecb42ad89c263d4094e35c2ed453039c15e06031c7bd49ab8b3a6ea053d7eb5cb6a6e57bfa05b1c760b
-
SSDEEP
24576:NPzcW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+hub:piecbzhBmLCQv8M
Malware Config
Extracted
xloader
2.3
jeiq
casuallyso.com
mismirasoles.com
nunostacos.com
zboubdiel.com
eternellebynh.com
radsum.info
sddianshang56.com
citriodiolspray.com
khoza3a.com
reelhooker-phuket.com
pumpbrokers.com
wallstreetbnb.com
realestatewithtiff.com
rockstarleading.com
goddesslovebeauty.com
zulaolao.com
openwateradventurers.com
xn--zqsv0e44iqw9c.space
lingxiaojiaoyu.com
wetrabbitexpress.com
Targets
-
-
Target
fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118
-
Size
1.2MB
-
MD5
fe346737f236e64f7b1f0120cf4fd261
-
SHA1
6901215d58e95a7bf12c0507c528f77d1c6329a4
-
SHA256
9be04bb6af5b7e9fe3073b948c345eee2491d61c985997d681ea253c7b62aa4c
-
SHA512
4753b08ebf22f06c31d1123fbdec5578d3b57805af512ecb42ad89c263d4094e35c2ed453039c15e06031c7bd49ab8b3a6ea053d7eb5cb6a6e57bfa05b1c760b
-
SSDEEP
24576:NPzcW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+hub:piecbzhBmLCQv8M
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-