Overview

overview

10

Static

static

3

94dfabcfd1...18.exe

windows7-x64

10

94dfabcfd1...18.exe

windows10-2004-x64

10

$PLUGINSDI...vb.dll

windows7-x64

3

$PLUGINSDI...vb.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    94dfabcfd1c2a9197ff2938cd52bad46_JaffaCakes118
  • Size 249KB
  • Sample240402-xy9rdaah72
  • SHA256 098a32bfcd332f71fdb65cf704994c70cf6390110340c809ae2cc66bddfbde04
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloadermxnuloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • mxnu

Decoy

  • insightmyhome.com

  • gabriellamaxey.com

  • 029atk.xyz

  • marshconstructions.com

  • technichoffghosts.com

  • blue-ivy-boutique-au.com

  • 1sunsetgroup.com

  • elfkuhnispb.store

  • caoliudh.club

  • verifiedpaypal.net

  • jellyice-tr.com

  • gatescres.com

  • bloomberq.online

  • crystaltopagent.net

  • uggs-line.com

  • ecommerceplatform.xyz

  • historyofcambridge.com

  • sattaking-gaziabad.xyz

  • digisor.com

  • beachpawsmobilegrooming.com

Targets

    • Target
      94dfabcfd1c2a9197ff2938cd52bad46_JaffaCakes118
    • Size 249KB
    • SHA256 098a32bfcd332f71fdb65cf704994c70cf6390110340c809ae2cc66bddfbde04
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloadermxnuloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/kwhtcvb.dll
    • Size 24KB
    • SHA256 48f8ef93b698568f608e762cacef1b29a80bcf54bde9534a1de426242e86209a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks