Overview

overview

10

Static

static

3

f0194f354a...18.exe

windows7-x64

10

f0194f354a...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f0194f354acfcdef542970496608eb99_JaffaCakes118
  • Size 714KB
  • Sample240415-c265fafa9s
  • SHA256 237a1e97a6c1bca59ddb80fd572c4f242d1fc90b0b1ad0d9996d8aba93c40b0a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderuqf5loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • uqf5

Decoy

  • suiddock.com

  • sweetgyalshop.com

  • puterigarden.com

  • orangestoreusa.com

  • prostirkarpat.com

  • ajierfoods.com

  • mindlablearning.com

  • factiive.net

  • beautifulbrokenhearts.com

  • direcionalreservapraca.com

  • tvhoki.com

  • themoderncoachinstitute.com

  • classactionwalgreens.com

  • haloog.com

  • sachinkaushik.com

  • daleearnhardtjrchevyvip.com

  • disconight.net

  • ocyslibes.icu

  • encounterfy.com

  • infamoudpapertrail.com

Targets

    • Target
      f0194f354acfcdef542970496608eb99_JaffaCakes118
    • Size 714KB
    • SHA256 237a1e97a6c1bca59ddb80fd572c4f242d1fc90b0b1ad0d9996d8aba93c40b0a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderuqf5loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks