General

  • Target

    9e2c5b22680ba4bbd6a878359de06f25_JaffaCakes118

  • Size

    473KB

  • Sample

    240403-dep33sec49

  • MD5

    9e2c5b22680ba4bbd6a878359de06f25

  • SHA1

    0fd148f8548e00ce55546cb8f47c7ed45a91b33d

  • SHA256

    76ae8a066744d281de1a7b1db736994aee95488fdf4bb8721f82348236e87521

  • SHA512

    bba4977afd82b635fc2f4071996d7dc501afe80ad8c92da202559b0966182b2394e64c963dcdc8efa3871f65e54460f26b8b226db01c1e67752e7cd2a58b82d6

  • SSDEEP

    6144:c2VKqAFfdPb+Gg+RxG5Rq8OC8zo3mV2Ex5SjOSB48OYIOqC1cJsoDvjllYj:BVKqAFfdKGleRTOiI76jG8OYIx4Svoj

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

s9ns

Decoy

livehd7.onl

comprosuasucata.com

rouvar.com

zamenapodani.quest

villahummingbird.com

vendaaprovadanosite.com

activeator.com

lapinlauluveikot.com

watch-tbn.net

schwesteroutfits.com

viviendactiva.com

quaythuocquynhchi.xyz

dasrekop.online

ch34k-3yfb124.club

fxb2bhub.com

lightlyenlightened.com

workdayconvert.com

pintod.com

mariimportados.com

globoicon.com

Targets

    • Target

      9e2c5b22680ba4bbd6a878359de06f25_JaffaCakes118

    • Size

      473KB

    • MD5

      9e2c5b22680ba4bbd6a878359de06f25

    • SHA1

      0fd148f8548e00ce55546cb8f47c7ed45a91b33d

    • SHA256

      76ae8a066744d281de1a7b1db736994aee95488fdf4bb8721f82348236e87521

    • SHA512

      bba4977afd82b635fc2f4071996d7dc501afe80ad8c92da202559b0966182b2394e64c963dcdc8efa3871f65e54460f26b8b226db01c1e67752e7cd2a58b82d6

    • SSDEEP

      6144:c2VKqAFfdPb+Gg+RxG5Rq8OC8zo3mV2Ex5SjOSB48OYIOqC1cJsoDvjllYj:BVKqAFfdKGleRTOiI76jG8OYIx4Svoj

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks