General
-
Target
085f6796a761a1f1dd252ef348f2fe69_JaffaCakes118
-
Size
478KB
-
Sample
240624-n5eedavbkj
-
MD5
085f6796a761a1f1dd252ef348f2fe69
-
SHA1
9abd15c6bc542b0bd8baa79f90540dd7f1f80af1
-
SHA256
b0787f51caf44390126cfb1e827d548139021e30bca2cf2e299917ea5788a8bf
-
SHA512
80ca49f471e3b53890869e4be0cfae82ce12367ce20b5436a5daa8c886f7e14f11b2de402ae714f53ac362b730a1fb104d981e99ab186b795e24ae8da4d2131f
-
SSDEEP
12288:Xd9ozJLSibqU65lOAVQsuCwBivjcK95u1t09b:LozlSDUiVQsVaIF
Malware Config
Extracted
xloader
2.3
uidr
dulichsongcham.com
cash-royal.com
geneseewildlifetrapping.com
9cc9x79m3y2.com
ntjjzx.com
joinglooko.com
upmchealhtrak.com
hookandcask.com
orca-web.com
ag3holdings.com
empoweredinvestmentstx.com
lustywall.com
rcpelaurentides.com
goyalcoorchidnirvanatwo.homes
iotajinn.com
littlemlive.com
hippocratesbio.com
ashleysema.design
175a45.xyz
bpocompaniesphilippines.com
Targets
-
-
Target
085f6796a761a1f1dd252ef348f2fe69_JaffaCakes118
-
Size
478KB
-
MD5
085f6796a761a1f1dd252ef348f2fe69
-
SHA1
9abd15c6bc542b0bd8baa79f90540dd7f1f80af1
-
SHA256
b0787f51caf44390126cfb1e827d548139021e30bca2cf2e299917ea5788a8bf
-
SHA512
80ca49f471e3b53890869e4be0cfae82ce12367ce20b5436a5daa8c886f7e14f11b2de402ae714f53ac362b730a1fb104d981e99ab186b795e24ae8da4d2131f
-
SSDEEP
12288:Xd9ozJLSibqU65lOAVQsuCwBivjcK95u1t09b:LozlSDUiVQsVaIF
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-