Overview

overview

10

Static

static

3

PRICE_REQU...DF.exe

windows7-x64

10

PRICE_REQU...DF.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    e3dc70be0bec3733776fe34306d4e40f_JaffaCakes118
  • Size 336KB
  • Sample240407-c2me2aag71
  • SHA256 150fa94ea2e5a0d01197b7404c8716b87a23154271342d5def957fa2b5192594
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloadersnaaloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • snaa

Decoy

  • ivetau.com

  • jupstudios.com

  • myvintagespecs.com

  • nineliveslabs.xyz

  • linahaljarad.com

  • itbling.com

  • bqmmw.com

  • danmgg.com

  • savalanxe.com

  • gasolinestation.info

  • blankedu.com

  • virginiacannabislawyer.com

  • jochichicago.com

  • herbwarts.com

  • bigcitygigs.com

  • gheeduvine.com

  • underwoodway.net

  • philosophia-perennis.club

  • milanodesk.com

  • myrandr.com

Targets

    • Target
      PRICE_REQUEST_00989_PDF.exe
    • Size 294KB
    • SHA256 c063613033c4be101d74aefe076f82f6183e35689137fc36a929cc5c40ea043d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloadersnaaloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks