Overview

overview

10

Static

static

3

94dfabcfd1...18.exe

windows7-x64

10

94dfabcfd1...18.exe

windows10-2004-x64

10

$PLUGINSDI...vb.dll

windows7-x64

3

$PLUGINSDI...vb.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    94dfabcfd1c2a9197ff2938cd52bad46_JaffaCakes118

  • Size

    249KB

  • Sample

    240402-xy9rdaah72

  • MD5

    94dfabcfd1c2a9197ff2938cd52bad46

  • SHA1

    8c7f75c3cf3d6a0c5bee876ee8b98045a186e154

  • SHA256

    098a32bfcd332f71fdb65cf704994c70cf6390110340c809ae2cc66bddfbde04

  • SHA512

    758bdc6b9f1dfb40c6b88ebac9a8fe7a09102172ae021af526f860e863a01f75e21cd4b332ae11a09b54cf67db900bbdd2bf9d5eeec7a9e6dab6798f6866c104

  • SSDEEP

    6144:wBlL/cZ9WISEFheSGP7nKlE1Iwc/9NuGRrsfcq+:Ce7PSOw/jwE1IwO3uat1

Score
10/10
xloadermxnuloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mxnu

Decoy

insightmyhome.com

gabriellamaxey.com

029atk.xyz

marshconstructions.com

technichoffghosts.com

blue-ivy-boutique-au.com

1sunsetgroup.com

elfkuhnispb.store

caoliudh.club

verifiedpaypal.net

jellyice-tr.com

gatescres.com

bloomberq.online

crystaltopagent.net

uggs-line.com

ecommerceplatform.xyz

historyofcambridge.com

sattaking-gaziabad.xyz

digisor.com

beachpawsmobilegrooming.com

Targets

    • Target

      94dfabcfd1c2a9197ff2938cd52bad46_JaffaCakes118

    • Size

      249KB

    • MD5

      94dfabcfd1c2a9197ff2938cd52bad46

    • SHA1

      8c7f75c3cf3d6a0c5bee876ee8b98045a186e154

    • SHA256

      098a32bfcd332f71fdb65cf704994c70cf6390110340c809ae2cc66bddfbde04

    • SHA512

      758bdc6b9f1dfb40c6b88ebac9a8fe7a09102172ae021af526f860e863a01f75e21cd4b332ae11a09b54cf67db900bbdd2bf9d5eeec7a9e6dab6798f6866c104

    • SSDEEP

      6144:wBlL/cZ9WISEFheSGP7nKlE1Iwc/9NuGRrsfcq+:Ce7PSOw/jwE1IwO3uat1

    Score
    10/10
    xloadermxnuloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/kwhtcvb.dll

    • Size

      24KB

    • MD5

      c47052adbbfd727643e1f813bbee9d0a

    • SHA1

      393318978321ed22187c5c81482399f253ffe1e2

    • SHA256

      48f8ef93b698568f608e762cacef1b29a80bcf54bde9534a1de426242e86209a

    • SHA512

      1dca295a1a76cf34e7b5e6463c3479ac42b1ec54486eba416c76248ef0a3ce63c1e4149eb9bc86a400c441210881c389957b0ffc04f6ba2880dde9daa5bada3c

    • SSDEEP

      384:Rrecw0IDT07tzQ7+Lw3tJnZ2qQLjA4t9WMAZc6WnJ520mNT3s+0XMug:DwN07hrw3DnNsaMAZE2jT8+eM

    Score
    3/10
    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Tasks