Overview

overview

10

Static

static

3

73fe142254...18.exe

windows7-x64

10

73fe142254...18.exe

windows10-2004-x64

7

$PLUGINSDI...tf.dll

windows7-x64

10

$PLUGINSDI...tf.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    73fe142254abec3aeaef375f0564d40a_JaffaCakes118

  • Size

    254KB

  • Sample

    240401-s5txaagf3x

  • MD5

    73fe142254abec3aeaef375f0564d40a

  • SHA1

    8529d972dd89f69eb2dc2a3ba9207e67626de9b9

  • SHA256

    19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5

  • SHA512

    848d4bc144f1f861823f08ab355184786f3832555236dffa2b5639e3ceb6c2578ff0da8c3870ba26f11f7609f0f4bbc50312db565c3a6adc6e8e3155915b328e

  • SSDEEP

    6144:wBlL/ciQDQb+FraDHtBcDelxJu1cjf8Zx/saJJrBORxOZbmkZFPd:CeltxaPR8mL8Zx3JJrhRZb

Score
10/10
xloaderkqnaloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

kqna

Decoy

achyutlifesciences.com

anthemmg.com

netkopat.com

generationgirlnaturals.com

novatel-network.com

craftstockco.com

thevishantiverse.art

elkerfly.com

haerotechs.com

candypalette.com

gregdokes.com

e-commerce.company

gratitudeland.com

companyintelcloud.com

publicyazilim.com

xc6811.com

aracsozluk.com

janesgalant.quest

fraserstephendop.com

ryan.rentals

Targets

    • Target

      73fe142254abec3aeaef375f0564d40a_JaffaCakes118

    • Size

      254KB

    • MD5

      73fe142254abec3aeaef375f0564d40a

    • SHA1

      8529d972dd89f69eb2dc2a3ba9207e67626de9b9

    • SHA256

      19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5

    • SHA512

      848d4bc144f1f861823f08ab355184786f3832555236dffa2b5639e3ceb6c2578ff0da8c3870ba26f11f7609f0f4bbc50312db565c3a6adc6e8e3155915b328e

    • SSDEEP

      6144:wBlL/ciQDQb+FraDHtBcDelxJu1cjf8Zx/saJJrBORxOZbmkZFPd:CeltxaPR8mL8Zx3JJrhRZb

    Score
    10/10
    xloaderkqnaloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/yhjjbtf.dll

    • Size

      33KB

    • MD5

      2109a0431e1e8fbce8007bc6dbdc8d2d

    • SHA1

      f85d1cfa01ca893063af01510115bc279da84c2a

    • SHA256

      520857c7a5bfaeebf0f39504ae85d32b7e153774e93cb2be486f9a5d35b76d05

    • SHA512

      a190901c467b65b18370aa3dbec9bb994294042fb78965b6baaf92a31fdc316912679a23f81f76a0d30f51c9c9ccbabcd58b0d420a1c6060508de1f0c0d320fb

    • SSDEEP

      384:173rOmBpuRkCafMEILJBJn0GMZEhE7flHeKCB5qktAX6KiAEHpMUK6rbT7:171YiCeIdBMZT7f5eL5XfLzMUKcbX

    Score
    10/10
    xloaderkqnaloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Tasks