Overview

overview

10

Static

static

$$$.exe

windows7_x64

10

$$$.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    $$$.exe
  • Size 761KB
  • Sample210927-k3bc6agcb7
  • SHA256 984dec79b881adf59d5308f52fddeda0fbccbd917b750f6ec9a5be1a1a4dc0fa
  • MD5 SHA1 SHA512
Score
10/10
xloaderjdt0loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • jdt0

C2

  • http://www.jen4x.com/jdt0/

Decoy

  • william188.com

  • kmknim.com

  • freedomnofear.com

  • industrialohare.com

  • devopswave.com

  • g1fz.com

  • aliceguidi.info

  • linkared.com

  • crossboda.com

  • lpddr3.com

  • ktnword.xyz

  • productsdesign.top

  • dulichnhatviet.com

  • piazzaassociates.com

  • inpude.com

  • kmi.contractors

  • getkyrobak.com

  • sportinggoodssuperstore.com

  • trifoly.info

  • aspectjudge.com

Targets

    • Target
      $$$.exe
    • Size 761KB
    • SHA256 984dec79b881adf59d5308f52fddeda0fbccbd917b750f6ec9a5be1a1a4dc0fa
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderjdt0loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks