Overview

overview

10

Static

static

3

326879d015...18.exe

windows7-x64

10

326879d015...18.exe

windows10-2004-x64

10

$PLUGINSDI...bh.dll

windows7-x64

3

$PLUGINSDI...bh.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    326879d0158d92efc02be27a534e2af4_JaffaCakes118
  • Size 253KB
  • Sample240330-d2vbbaga8v
  • SHA256 b17b8be05fc8389990be623a727369826383bfc2fb33693943f208faa184ff40
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderu5ehloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • u5eh

Decoy

  • tryafaq.com

  • bobcathntshop.com

  • oglead.com

  • 026skz.xyz

  • brasbux.com

  • adna17.com

  • noveltyrofjiy.xyz

  • realestatecompanys.com

  • leman-web.com

  • df5686.com

  • jonathonhawkins.com

  • juliedominyfloralartistry.com

  • classyeventsco.com

  • aquaticatt.com

  • iotworld.xyz

  • hoc8.com

  • disposablediapers.store

  • peregovorim.online

  • advancebits.club

  • getaburialplan.com

Targets

    • Target
      326879d0158d92efc02be27a534e2af4_JaffaCakes118
    • Size 253KB
    • SHA256 b17b8be05fc8389990be623a727369826383bfc2fb33693943f208faa184ff40
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderu5ehloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/jmmnbh.dll
    • Size 33KB
    • SHA256 f0ed5b1f290b36168d3cdce44b29a92dde64b558b350576431983f902fedeb8e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks