General
-
Target
9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118
-
Size
425KB
-
Sample
240611-wtymwawenj
-
MD5
9f1a5e5c6a5c5493459010d43af8f504
-
SHA1
56ed32addbac6dd6f1fe2ddfb4add70c04a1596d
-
SHA256
652ed909a2087f6e3eeec91c002f66d4f9256e809439d2e081031e0776803e6c
-
SHA512
5a2b2077abb729fd4f186a81e6941b04dc59c7b1a4173ffd1db8aea4c9d9e7a628958ff577bc46b85cba3ca597642c766c85f83670bc1fc5345616930baa3fe1
-
SSDEEP
12288:wHFZ2iNHv2zv1gt1jnqgS7+QkNdlVR81TasQw8Mgy:41c2tpnc7Md/R893V8Mgy
Malware Config
Extracted
xloader
2.1
pzba
cafeblanca.net
goodvibrationswindchimes.com
mydmapp.com
isabelpasadaspsicologa.com
adonustmuseum.com
oghomeinfoa18.club
asia-ivoyage.com
chargegamehair.com
78500802.xyz
siteoficialcliqueagora.com
kanchanspice.com
elysalesgh.com
zbarrier.com
mariedietze.fyi
ppope.com
bluechipsgroup.company
mineola.education
covkpbac.icu
bettercityhomes.com
elevenlevels.com
Targets
-
-
Target
9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118
-
Size
425KB
-
MD5
9f1a5e5c6a5c5493459010d43af8f504
-
SHA1
56ed32addbac6dd6f1fe2ddfb4add70c04a1596d
-
SHA256
652ed909a2087f6e3eeec91c002f66d4f9256e809439d2e081031e0776803e6c
-
SHA512
5a2b2077abb729fd4f186a81e6941b04dc59c7b1a4173ffd1db8aea4c9d9e7a628958ff577bc46b85cba3ca597642c766c85f83670bc1fc5345616930baa3fe1
-
SSDEEP
12288:wHFZ2iNHv2zv1gt1jnqgS7+QkNdlVR81TasQw8Mgy:41c2tpnc7Md/R893V8Mgy
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-