General

  • Target

    962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118

  • Size

    1.3MB

  • Sample

    240402-y1zvmacd4w

  • MD5

    962ae24141e7b1abf36ae99d1fbc7315

  • SHA1

    bff36581aae1b402d2542190d89faf07fcdd2680

  • SHA256

    61a69b0eb00727462d5599153fb2acb617d15fcc2e9e4ec3270a5fca8837a3ba

  • SHA512

    46f9e98ad3440d8fa079ca7431face86ddf46850de4ee7f5c220ac1fa4738646a6862e0895797d83e52f9b1f24117b7259ac33b02405ac72f0135e8ff33e1072

  • SSDEEP

    24576:196uxv82aMVxkN0m9KYR665AoUv8xmlBp49Ax5v7WPDFIgY:19zjalOm046IArUqi9A7v6ZIJ

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b65i

Decoy

leofighters.com

smartat2.xyz

encontrevariedades.com

jimwilliamstutoring.com

kanpaiecuador.com

accura-inv.com

xtzgjxzz.com

scentstrategies.com

high-clicks2.com

hadishgebray.com

woodlawnbailbonds.com

dmsolutionsco.com

rdvulm21.com

beachyweens.com

ishirmansingh.com

rimmasbracelets.com

kellibrat.com

roselmasm.com

datkamoney.info

fermers.club

Targets

    • Target

      962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118

    • Size

      1.3MB

    • MD5

      962ae24141e7b1abf36ae99d1fbc7315

    • SHA1

      bff36581aae1b402d2542190d89faf07fcdd2680

    • SHA256

      61a69b0eb00727462d5599153fb2acb617d15fcc2e9e4ec3270a5fca8837a3ba

    • SHA512

      46f9e98ad3440d8fa079ca7431face86ddf46850de4ee7f5c220ac1fa4738646a6862e0895797d83e52f9b1f24117b7259ac33b02405ac72f0135e8ff33e1072

    • SSDEEP

      24576:196uxv82aMVxkN0m9KYR665AoUv8xmlBp49Ax5v7WPDFIgY:19zjalOm046IArUqi9A7v6ZIJ

    • Detect ZGRat V1

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Xloader payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks