Overview

overview

10

Static

static

3

98d2d5ac3b...18.exe

windows7-x64

10

98d2d5ac3b...18.exe

windows10-2004-x64

10

$PLUGINSDI...bu.dll

windows7-x64

3

$PLUGINSDI...bu.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    98d2d5ac3bd493d77f0a7300a43d045b_JaffaCakes118
  • Size 450KB
  • Sample240402-2d36baff76
  • SHA256 1bbc8a34b7590c1593c5a79a8d0f93b17a162f44893c37aa11e4cb9e0e2d96bf
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderb2c0loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • b2c0

Decoy

  • bjyxszd520.xyz

  • hsvfingerprinting.com

  • elliotpioneer.com

  • bf396.com

  • chinaopedia.com

  • 6233v.com

  • shopeuphoricapparel.com

  • loccssol.store

  • truefictionpictures.com

  • playstarexch.com

  • peruviancoffee.store

  • shobhajoshi.com

  • philme.net

  • avito-rules.com

  • independencehomecenters.com

  • atp-cayenne.com

  • invetorsbank.com

  • sasanos.com

  • scentfreebnb.com

  • catfuid.com

Targets

    • Target
      98d2d5ac3bd493d77f0a7300a43d045b_JaffaCakes118
    • Size 450KB
    • SHA256 1bbc8a34b7590c1593c5a79a8d0f93b17a162f44893c37aa11e4cb9e0e2d96bf
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderb2c0loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/gyalquzbu.dll
    • Size 33KB
    • SHA256 db7b70b0734285b8d9a1f3617e55603b0cb649d9bf0b7fbf8988c44e684f4e76
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks