Overview

overview

10

Static

static

3

a86077cd62...18.exe

windows7-x64

10

a86077cd62...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    a86077cd62754805e944847a8b1aa517_JaffaCakes118
  • Size 661KB
  • Sample240403-2ecdzsfb96
  • SHA256 64b041387c3c512a5b43c2a1d811b35f18f4d537c522dafb7b3e736912907426
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderi6rdloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • i6rd

Decoy

  • ritotvmount.xyz

  • szxhpfk.com

  • yatakturkiye.com

  • belugacdn.xyz

  • doralopen.com

  • gongzyrxzlhurhhhvdclmddi.store

  • lyvconsulting.com

  • it-pampering.com

  • weerwi.com

  • phdelivery1.store

  • neofluentsurf.com

  • lainsurance.xyz

  • ietaricardocastellarbarrios.com

  • despachantemedeiros.digital

  • madnext.online

  • serenity.holdings

  • rfvb.club

  • nickroche.online

  • hnjst.net

  • wolkeverts.quest

Targets

    • Target
      a86077cd62754805e944847a8b1aa517_JaffaCakes118
    • Size 661KB
    • SHA256 64b041387c3c512a5b43c2a1d811b35f18f4d537c522dafb7b3e736912907426
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderi6rdloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks