Overview

overview

10

Static

static

3

f23ce10bec...18.exe

windows7-x64

10

f23ce10bec...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f23ce10beca49b9fb15f9cfda7c47ca9_JaffaCakes118
  • Size 395KB
  • Sample240416-afpl6aca82
  • SHA256 9f863c400c0f7ef5153fd38edda4137b13143278de8b06de05b9323e91c974d4
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderb5celoaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • b5ce

Decoy

  • advellerd.xyz

  • giasuvina.com

  • arab-xt-pro.com

  • ahsltu2ua4.com

  • trasportesemmanuel.com

  • kissimmeesoccercup.com

  • studyengland.com

  • m2volleyballclub.com

  • shyuehuan.com

  • elsml.com

  • blog-x-history.top

  • coditeu.com

  • allattachments.net

  • vigautruc.com

  • mentication.com

  • zambiaedu.xyz

  • filadelfiacenter.com

  • avlaborsourceinc.info

  • tameka-stewart.com

  • studio-cleo.com

Targets

    • Target
      f23ce10beca49b9fb15f9cfda7c47ca9_JaffaCakes118
    • Size 395KB
    • SHA256 9f863c400c0f7ef5153fd38edda4137b13143278de8b06de05b9323e91c974d4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderb5celoaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks