Overview

overview

10

Static

static

3

5d054d358e...18.exe

windows7-x64

10

5d054d358e...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5d054d358e94c8b282b9c0e6ba2185c9_JaffaCakes118
  • Size 550KB
  • Sample240331-yztl8abf29
  • SHA256 c53c1098e4621c2258d13bd6c36d95493343129c5846f6c0ca07c12565da843d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloadersg5cloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • sg5c

Decoy

  • chosenstoryto-detecttoday.info

  • eighthundredthousand.info

  • objectionportal.com

  • thelitsi.store

  • techbridgeassociates.com

  • noctilucaart.com

  • lift2.cloud

  • ureflective.com

  • tmongpil.com

  • hhhsccultum.quest

  • lzagc.com

  • jobs-fp.com

  • dalvarostyle.com

  • mushrelax.com

  • smokersoutletinc.com

  • centralenergi.com

  • bodepuro.com

  • no562.com

  • vintagechateauii.com

  • thriftyniftyandfine.com

Targets

    • Target
      5d054d358e94c8b282b9c0e6ba2185c9_JaffaCakes118
    • Size 550KB
    • SHA256 c53c1098e4621c2258d13bd6c36d95493343129c5846f6c0ca07c12565da843d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloadersg5cloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks