xloader

General

Target

0031a23b4bb6abcdccc5f8122de5fcb5_JaffaCakes118
Size

283KB
Sample

240328-hzha7ach52
MD5

0031a23b4bb6abcdccc5f8122de5fcb5
SHA1

be50cdbb0af4c77229e3de0ec7f34088aae64dc2
SHA256

2ffbb436257f6f348fade42e94df5737ab8b9d9848a220206992c52d917a7b5e
SHA512

eed60bda2d0a5fb02f823db8caf57d136dc6d003f49ca7d3cb6a620dcb1cf4ad4e52c6b9a40aefe9126f9e137776ae23d78a2648f5609fa3d69989ab3d185cc2
SSDEEP

6144:wBlL/c7HU+ICkZsFE03JDT37iHxU1D/RmNOZeXBiFkJTstHJXd0mU:Ce7HUDCysO0dLiWDc8ZHKmHImU

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mxnu

Decoy

insightmyhome.com

gabriellamaxey.com

029atk.xyz

marshconstructions.com

technichoffghosts.com

blue-ivy-boutique-au.com

1sunsetgroup.com

elfkuhnispb.store

caoliudh.club

verifiedpaypal.net

jellyice-tr.com

gatescres.com

bloomberq.online

crystaltopagent.net

uggs-line.com

ecommerceplatform.xyz

historyofcambridge.com

sattaking-gaziabad.xyz

digisor.com

beachpawsmobilegrooming.com

Targets

- Target
  
  0031a23b4bb6abcdccc5f8122de5fcb5_JaffaCakes118
- Size
  
  283KB
- MD5
  
  0031a23b4bb6abcdccc5f8122de5fcb5
- SHA1
  
  be50cdbb0af4c77229e3de0ec7f34088aae64dc2
- SHA256
  
  2ffbb436257f6f348fade42e94df5737ab8b9d9848a220206992c52d917a7b5e
- SHA512
  
  eed60bda2d0a5fb02f823db8caf57d136dc6d003f49ca7d3cb6a620dcb1cf4ad4e52c6b9a40aefe9126f9e137776ae23d78a2648f5609fa3d69989ab3d185cc2
- SSDEEP
  
  6144:wBlL/c7HU+ICkZsFE03JDT37iHxU1D/RmNOZeXBiFkJTstHJXd0mU:Ce7HUDCysO0dLiWDc8ZHKmHImU
Score

10^/10

xloader mxnu loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader payload
  rat
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/dulsmde.dll
- Size
  
  105KB
- MD5
  
  9dcfa8231f1896ca0d48d53fb116841d
- SHA1
  
  13f92a4af7931b2aabd918d6d3cf4589e316331b
- SHA256
  
  6e1d37a9909f1774db945f4427800e4d0b821fdca41598f12dba41b59fa3c901
- SHA512
  
  75d3a9ff265971c659444bd13fc28f90a77e0ce709a34a6c46f9ec75fd7f337df5dbf5ec74b4129890b4b724e40aa10863f6d8d7e74a747ce7c5311f97513d09
- SSDEEP
  
  1536:MOFgGAexpLuHJsu05OpmubCPMG9zpEENfuJSPRHKarriUCy3WklS9ncobUfs/MdL:hFgGA8uq9Bn1bJCyxlSrbMdyqWU
Score

3^/10
behavioral3 behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader payload

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4