Overview

overview

10

Static

static

3

0a0b65f309...18.exe

windows7-x64

10

0a0b65f309...18.exe

windows10-2004-x64

10

$PLUGINSDI...zg.dll

windows7-x64

10

$PLUGINSDI...zg.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a0b65f309a35b8c4f2976a97363c398_JaffaCakes118

  • Size

    249KB

  • Sample

    240328-tle5fsad3v

  • MD5

    0a0b65f309a35b8c4f2976a97363c398

  • SHA1

    14d9e3a08571169103420909073ac186ae034eee

  • SHA256

    7d193ee636a32820be667d76f35258c087604539f5a52a442ba947339eb8ae58

  • SHA512

    c66de247b8ced1a86eecff73823767b6349a8983267a00bb3f7e5ad7644cbb3fededf442590a32c8dd571c2d83575aa9d49fd69677ce050d5d2bb20f8edbc10b

  • SSDEEP

    6144:wBlL/crvqxLvnth1Pi9I0qI9wCG7QSTVOqfiDI6CH4/PGNZa0QYo:CervcvnHFJ0L9wCG7QSraDIFH4/PmA

Score
10/10
xloadermxnuloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mxnu

Decoy

insightmyhome.com

gabriellamaxey.com

029atk.xyz

marshconstructions.com

technichoffghosts.com

blue-ivy-boutique-au.com

1sunsetgroup.com

elfkuhnispb.store

caoliudh.club

verifiedpaypal.net

jellyice-tr.com

gatescres.com

bloomberq.online

crystaltopagent.net

uggs-line.com

ecommerceplatform.xyz

historyofcambridge.com

sattaking-gaziabad.xyz

digisor.com

beachpawsmobilegrooming.com

Targets

    • Target

      0a0b65f309a35b8c4f2976a97363c398_JaffaCakes118

    • Size

      249KB

    • MD5

      0a0b65f309a35b8c4f2976a97363c398

    • SHA1

      14d9e3a08571169103420909073ac186ae034eee

    • SHA256

      7d193ee636a32820be667d76f35258c087604539f5a52a442ba947339eb8ae58

    • SHA512

      c66de247b8ced1a86eecff73823767b6349a8983267a00bb3f7e5ad7644cbb3fededf442590a32c8dd571c2d83575aa9d49fd69677ce050d5d2bb20f8edbc10b

    • SSDEEP

      6144:wBlL/crvqxLvnth1Pi9I0qI9wCG7QSTVOqfiDI6CH4/PGNZa0QYo:CervcvnHFJ0L9wCG7QSraDIFH4/PmA

    Score
    10/10
    xloadermxnuloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/dpzqzg.dll

    • Size

      31KB

    • MD5

      9bdddd9535bf57393703d05ec9dd555d

    • SHA1

      d2ddba9150c10d60216ccd6fe87082d0babb9c84

    • SHA256

      8a6442971a1c7f3ed896d6feebcdc009d71570a6a144ad70178c6123cc1d90ce

    • SHA512

      8643eb9d9bfc23f349fc7e8aa27f6b3e9783a52d819df9a76edfae3abb021c3a348eea0b6a77d4267df363fd2a758049eef4e9e10dba155c3e0eeaf38d915e86

    • SSDEEP

      384:y8fNgOuCHP+Ang3eF+6Kswci/+9YFju5kKQHZ8Fz7cs2NugH7bVF4JtQ3sDLnDT2:1kpszi/1u2KQKZ7cs24gdF2tjPDTt

    Score
    10/10
    xloadermxnuloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Tasks