xloader

General

Target

b610b5c669611fbb55ed5965a8cd0c10_JaffaCakes118
Size

252KB
Sample

240404-mmmscsce4x
MD5

b610b5c669611fbb55ed5965a8cd0c10
SHA1

ecd743dc78d7aedaf33ffe0ddb8a6f242cb28b87
SHA256

062a33046cca90bc6364cc29ccd47ae7f4165d388f5fb699bb88c35c4509bb90
SHA512

33a51739fb7daed438c380fa54a9f8a39d80fffd5da709fab6bd2ccadc156c03a349bda89c4ee2677d4a1cf1fc2b7428be6cc005188b9d2305f7205020c220c3
SSDEEP

6144:wBlL/cN3UreO/tziKfxNBO9673wxrimNgxeh11/eHfiZ:CeN3U9IK5wxrPisz0o

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mxnu

Decoy

insightmyhome.com

gabriellamaxey.com

029atk.xyz

marshconstructions.com

technichoffghosts.com

blue-ivy-boutique-au.com

1sunsetgroup.com

elfkuhnispb.store

caoliudh.club

verifiedpaypal.net

jellyice-tr.com

gatescres.com

bloomberq.online

crystaltopagent.net

uggs-line.com

ecommerceplatform.xyz

historyofcambridge.com

sattaking-gaziabad.xyz

digisor.com

beachpawsmobilegrooming.com

Targets

- Target
  
  b610b5c669611fbb55ed5965a8cd0c10_JaffaCakes118
- Size
  
  252KB
- MD5
  
  b610b5c669611fbb55ed5965a8cd0c10
- SHA1
  
  ecd743dc78d7aedaf33ffe0ddb8a6f242cb28b87
- SHA256
  
  062a33046cca90bc6364cc29ccd47ae7f4165d388f5fb699bb88c35c4509bb90
- SHA512
  
  33a51739fb7daed438c380fa54a9f8a39d80fffd5da709fab6bd2ccadc156c03a349bda89c4ee2677d4a1cf1fc2b7428be6cc005188b9d2305f7205020c220c3
- SSDEEP
  
  6144:wBlL/cN3UreO/tziKfxNBO9673wxrimNgxeh11/eHfiZ:CeN3U9IK5wxrPisz0o
Score

10^/10

xloader mxnu loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader payload
  rat
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/rznjhun.dll
- Size
  
  32KB
- MD5
  
  49e3e63ae4d93b065720946ee9cfb161
- SHA1
  
  35634d8953dc28f7d5f9712e0f9839142f142a59
- SHA256
  
  7df0582dfc9b39225e3f5db2c9d707f392fa0cf96c440388bc97f792de260563
- SHA512
  
  30a3171524548d60451ecc6e8f6c95315d7e60d4a69e54071e7ef54a916ab4e59ab4d02d5eddf12073ebffc8fc8127eedf133f787ffcb0e8e0f30f9bf699c1d6
- SSDEEP
  
  384:Do2cnM5TGPOd/sWmfCc89ZpfUXBvqGz7z73pp/rgU/r0tTd/eWU9B3nfKAOBjn/7:02vHjphGX/rgUD0tx/Y3nSz9b
Score

3^/10
behavioral3 behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader payload

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4