Overview

overview

10

Static

static

3

czOxHskgIAQwZ8m.exe

windows7-x64

10

czOxHskgIAQwZ8m.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6048d2cc24be326d2ede052bb52c19fa_JaffaCakes118
  • Size 508KB
  • Sample240331-2ql3kaed4x
  • SHA256 2115a61103609e2f05e93ad1f8a18a21ef5f9a718e765c7bd7fc91e2cf6ba619
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderamb4loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • amb4

Decoy

  • ameerkabob.com

  • wenzhikeji.online

  • ktnsoil.xyz

  • dock7rods.com

  • simbaimmigration.com

  • tanahvilamalino.online

  • amaozn-co-jp.xyz

  • atahukukbafra.com

  • attruth.net

  • jigservices.net

  • 310indianway.com

  • freelotto.online

  • mylanding-page.com

  • dudemealprep.com

  • wellmaintainedhealth.com

  • vitemonprenom.com

  • laurynfauntroy.com

  • pilotmom.info

  • arpatientsapp.com

  • sendangdigital.com

Targets

    • Target
      czOxHskgIAQwZ8m.exe
    • Size 425KB
    • SHA256 856b8775a8063900378a815cd03d0f9628c4296eddd93ac9e9cd52269178c079
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderamb4loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks