General

  • Target

    f0740682e5d4fcd5ed0e2e6006aed5cf_JaffaCakes118

  • Size

    344KB

  • Sample

    240415-gg4wssgb43

  • MD5

    f0740682e5d4fcd5ed0e2e6006aed5cf

  • SHA1

    17f5c837862bc0243f55de664f91a8a195ca3a34

  • SHA256

    eef7bfbe59617838031db137e1c71c315dd465500fcebca0aef1d252422b4b7a

  • SHA512

    e54ef90f665832bcaa863b021b0f3192acc5d1b42e4afbfbb208cb5a4385c0ad21955cbbe169f6188959d3456a8d20197010f5916c80a1fc1a315a702207b40d

  • SSDEEP

    6144:or1otBTW/urWZ6klh35QjEC74CYxsUIsDPiLPPB9Kp8kOI7iBe:m6BTW/u9C5AEtIsDKxW0Im

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

u3r5

Decoy

alashan.ltd

demopagephequan.online

garxznql.icu

unetart.com

dajiangzhibo15.com

influencer.fund

beverlyhills.city

strefafryzur.net

giftboxhawaii.com

ecotiare.com

homeandgardenradioshow.com

sageandsandco.com

laflesoley.com

icipatanegra.online

autovistoriapredial.net

xn--polenezkypark-pmb.com

cbdamic.com

aaronandmarissa.com

datasoma.digital

theclosetology.com

Targets

    • Target

      f0740682e5d4fcd5ed0e2e6006aed5cf_JaffaCakes118

    • Size

      344KB

    • MD5

      f0740682e5d4fcd5ed0e2e6006aed5cf

    • SHA1

      17f5c837862bc0243f55de664f91a8a195ca3a34

    • SHA256

      eef7bfbe59617838031db137e1c71c315dd465500fcebca0aef1d252422b4b7a

    • SHA512

      e54ef90f665832bcaa863b021b0f3192acc5d1b42e4afbfbb208cb5a4385c0ad21955cbbe169f6188959d3456a8d20197010f5916c80a1fc1a315a702207b40d

    • SSDEEP

      6144:or1otBTW/urWZ6klh35QjEC74CYxsUIsDPiLPPB9Kp8kOI7iBe:m6BTW/u9C5AEtIsDKxW0Im

    • Detect ZGRat V1

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Xloader payload

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Tasks