Overview

overview

10

Static

static

3

222edb446a...18.exe

windows7-x64

10

222edb446a...18.exe

windows10-2004-x64

7

$PLUGINSDIR/tgnao.dll

windows7-x64

10

$PLUGINSDIR/tgnao.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    222edb446ae73e059a6d50d07741f24c_JaffaCakes118

  • Size

    255KB

  • Sample

    240329-pt5b4agg5z

  • MD5

    222edb446ae73e059a6d50d07741f24c

  • SHA1

    fb2c10180167c27b6a92d877a3ca722a97a94a72

  • SHA256

    6f647afcbbfcefe1f393f978a3c684bce3da2ac4b2c9d3723f3c8de8a75edae4

  • SHA512

    f259ff40b25b5702ee00144a52c8a4835de071311b86fb15becfd7a814246438d550734cb283286f5efec476c8f1f4b4a3a6d7772dcfefe2cce4ae12a9c27ebe

  • SSDEEP

    6144:wBlL/cgqbcuqU49RgBwee9DQssSGvTr8H0hKqowV0:Cegqod6BwH8lBZos0

Score
10/10
xloadermxnuloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mxnu

Decoy

insightmyhome.com

gabriellamaxey.com

029atk.xyz

marshconstructions.com

technichoffghosts.com

blue-ivy-boutique-au.com

1sunsetgroup.com

elfkuhnispb.store

caoliudh.club

verifiedpaypal.net

jellyice-tr.com

gatescres.com

bloomberq.online

crystaltopagent.net

uggs-line.com

ecommerceplatform.xyz

historyofcambridge.com

sattaking-gaziabad.xyz

digisor.com

beachpawsmobilegrooming.com

Targets

    • Target

      222edb446ae73e059a6d50d07741f24c_JaffaCakes118

    • Size

      255KB

    • MD5

      222edb446ae73e059a6d50d07741f24c

    • SHA1

      fb2c10180167c27b6a92d877a3ca722a97a94a72

    • SHA256

      6f647afcbbfcefe1f393f978a3c684bce3da2ac4b2c9d3723f3c8de8a75edae4

    • SHA512

      f259ff40b25b5702ee00144a52c8a4835de071311b86fb15becfd7a814246438d550734cb283286f5efec476c8f1f4b4a3a6d7772dcfefe2cce4ae12a9c27ebe

    • SSDEEP

      6144:wBlL/cgqbcuqU49RgBwee9DQssSGvTr8H0hKqowV0:Cegqod6BwH8lBZos0

    Score
    10/10
    xloadermxnuloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/tgnao.dll

    • Size

      42KB

    • MD5

      0f843d7e73347478343042f25805462a

    • SHA1

      628f56b56f0582d87e5faf73f0240677c4afcd46

    • SHA256

      7fde1d9b48ef577fd75446e8c404fe228158026f72a7fd3c3c26790d7b52f55d

    • SHA512

      6e6b5f7c3353c520918d16a4bb85d0ddc887205beedc7811c80a85255b010530c124dd2e83720b40b4243eaa6c375669171ce0f813deb956f6f5340663164abe

    • SSDEEP

      768:VAPP+QGh7jiQj0BxiqwdSyTdYLosSvCyLu4A/WGNJ/u0KJJ:VAPWQ87eXWqwyLeu4A/vNJW0Kj

    Score
    10/10
    xloadermxnuloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks