General

  • Target

    97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118

  • Size

    457KB

  • Sample

    240402-1d937aeb4z

  • MD5

    97bc9fc82cdd0607f0bd1e83622b80ba

  • SHA1

    b066758974a6efef88abd3e772171a4bab89d1e8

  • SHA256

    7a12f38cc2bd503f9667620f86315281e8319f9f2dca72aa19eb19ff6f3629a6

  • SHA512

    b81cf826017f05a7a1d4fa42e61a0da20cbb5b7f02a90881bcdc01f24b64b1880f7078328082d29d9b3fbd957de8fff164f23b0f564fb7f41128841ed7b9ccc2

  • SSDEEP

    6144:FBlL/H4sYGXW+W9PTqKkq0KjtS8AE5gktrPnO1+RJRUw167GVRiG62:TKGXW+WJTe8xSAgktTOoRJ+wCSkG5

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b65i

Decoy

leofighters.com

smartat2.xyz

encontrevariedades.com

jimwilliamstutoring.com

kanpaiecuador.com

accura-inv.com

xtzgjxzz.com

scentstrategies.com

high-clicks2.com

hadishgebray.com

woodlawnbailbonds.com

dmsolutionsco.com

rdvulm21.com

beachyweens.com

ishirmansingh.com

rimmasbracelets.com

kellibrat.com

roselmasm.com

datkamoney.info

fermers.club

Targets

    • Target

      97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118

    • Size

      457KB

    • MD5

      97bc9fc82cdd0607f0bd1e83622b80ba

    • SHA1

      b066758974a6efef88abd3e772171a4bab89d1e8

    • SHA256

      7a12f38cc2bd503f9667620f86315281e8319f9f2dca72aa19eb19ff6f3629a6

    • SHA512

      b81cf826017f05a7a1d4fa42e61a0da20cbb5b7f02a90881bcdc01f24b64b1880f7078328082d29d9b3fbd957de8fff164f23b0f564fb7f41128841ed7b9ccc2

    • SSDEEP

      6144:FBlL/H4sYGXW+W9PTqKkq0KjtS8AE5gktrPnO1+RJRUw167GVRiG62:TKGXW+WJTe8xSAgktTOoRJ+wCSkG5

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader payload

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    • Target

      $PLUGINSDIR/nrxdd.dll

    • Size

      42KB

    • MD5

      5a5c717c752014c115f8cd5269d09230

    • SHA1

      9e98b8f7fc33c2a635b7fafae816e70a991db637

    • SHA256

      bbd19853959f6a7e000b9bd1880416753f9129294efc7b5eba835891b4034459

    • SHA512

      350f82e6eda8687197d911cddd6d84f734e77f63d538062c49298076db297907643f8771544000d4697d5c3f3995b488ef787a5ba132c89f6b2fba6b5be9a361

    • SSDEEP

      768:fAidP+QzDl79yqZw0yAkKjGZbjtY7xgUnNfzyX6ZAunOVfG2WgkhRw:fAMWQzh7kqfkRtY1gQ06ZAumkM

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks