Overview

overview

10

Static

static

3

e74da43c10...18.exe

windows7-x64

10

e74da43c10...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e74da43c10752c24480ed5a858a2575c_JaffaCakes118

  • Size

    803KB

  • Sample

    240408-m1swjafe36

  • MD5

    e74da43c10752c24480ed5a858a2575c

  • SHA1

    cd0cf92a7f91c3d40fa227a74e64b2ab17b2d8c1

  • SHA256

    3475cf4c5baf7775978dd90e069a76969ea94af43adc5e66ba0b931fed7d2106

  • SHA512

    3a0ce9d27a239a1fb209df8e78b60e99b2c212290b31bc4ebf2454e7b9845deeaf4edc47ebf378d0495a3eece98a23ebe9100f24876a9383fda7cd35d4d19117

  • SSDEEP

    12288:fb3bJeB6MaiyYxPrv8FOXxfMmWvkjiObHB7o:zcokCFWxfT5iO2

Score
10/10
xloaderuidrloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

uidr

Decoy

dulichsongcham.com

cash-royal.com

geneseewildlifetrapping.com

9cc9x79m3y2.com

ntjjzx.com

joinglooko.com

upmchealhtrak.com

hookandcask.com

orca-web.com

ag3holdings.com

empoweredinvestmentstx.com

lustywall.com

rcpelaurentides.com

goyalcoorchidnirvanatwo.homes

iotajinn.com

littlemlive.com

hippocratesbio.com

ashleysema.design

175a45.xyz

bpocompaniesphilippines.com

Targets

    • Target

      e74da43c10752c24480ed5a858a2575c_JaffaCakes118

    • Size

      803KB

    • MD5

      e74da43c10752c24480ed5a858a2575c

    • SHA1

      cd0cf92a7f91c3d40fa227a74e64b2ab17b2d8c1

    • SHA256

      3475cf4c5baf7775978dd90e069a76969ea94af43adc5e66ba0b931fed7d2106

    • SHA512

      3a0ce9d27a239a1fb209df8e78b60e99b2c212290b31bc4ebf2454e7b9845deeaf4edc47ebf378d0495a3eece98a23ebe9100f24876a9383fda7cd35d4d19117

    • SSDEEP

      12288:fb3bJeB6MaiyYxPrv8FOXxfMmWvkjiObHB7o:zcokCFWxfT5iO2

    Score
    10/10
    xloaderuidrloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks