Overview

overview

10

Static

static

3

331c15b010...18.exe

windows7-x64

10

331c15b010...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    331c15b0107b096b2ccfbc4867c1e2f3_JaffaCakes118
  • Size 554KB
  • Sample240330-elyt8shb69
  • SHA256 15624bebe7e780932d151ba3b3a65ecd16b0762597a63b76e51f85c375261c10
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderrca2loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • rca2

Decoy

  • bapzcosmetics.com

  • skillsgage.com

  • mingshiweiye.com

  • dcc-compliance.com

  • emprenbook.com

  • firn.site

  • haryanaricemil.com

  • fleetwoodfoods.com

  • jlnxhbkj.com

  • surajsanyal.com

  • jubakey.com

  • auroraunitedshippingco.com

  • propolis-surabaya.com

  • vasinvestments.com

  • breederschallenge.com

  • tafcoo.com

  • 417motoringparts.com

  • livemis.com

  • drainassist.com

  • kristenguestart.com

Targets

    • Target
      331c15b0107b096b2ccfbc4867c1e2f3_JaffaCakes118
    • Size 554KB
    • SHA256 15624bebe7e780932d151ba3b3a65ecd16b0762597a63b76e51f85c375261c10
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderrca2loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks