Overview

overview

10

Static

static

3

f5e7bf270b...18.exe

windows7-x64

10

f5e7bf270b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f5e7bf270b60cd8a71fc8be79ea7aae4_JaffaCakes118

  • Size

    298KB

  • Sample

    240417-qy28zaaa62

  • MD5

    f5e7bf270b60cd8a71fc8be79ea7aae4

  • SHA1

    e9361f22d9b0a2aba641b9cedbaa203ac32e30c6

  • SHA256

    88a982fd729f861a4439a59e632a7d76eb033991c437a2368bc2a834873f1f8a

  • SHA512

    cea75189109aab37974c7f57b7008c18755e362658ef47cfc093708fbe8b8ef06383458f898ebf11b1359b334980a70d18604a79265176d4773c3dfdfe4ab097

  • SSDEEP

    6144:jCeJW1DhGOWLpoLuVLhiade0Huq8PGMZW/d+2t7i+:/WJhGOWLpogLAa40+PGMZHe7l

Score
10/10
xloaderpagiloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

pagi

Decoy

makehrworkable.com

sound-wisdom.com

blacts.com

caenantglamping.com

meridiancpas.com

draughtedinn.co.uk

windywoodshc.com

mintmovileplus.com

pubgeventdailylogin.com

thesocialdzr.com

holapv.com

racevc.com

openpula.pro

wepreventstroke.com

autoclosy.com

enginkarabacak.com

15096eec1652.info

buildthefoundation.net

pwilliamberciklaw.com

paramountrevenueadvisors.com

Targets

    • Target

      f5e7bf270b60cd8a71fc8be79ea7aae4_JaffaCakes118

    • Size

      298KB

    • MD5

      f5e7bf270b60cd8a71fc8be79ea7aae4

    • SHA1

      e9361f22d9b0a2aba641b9cedbaa203ac32e30c6

    • SHA256

      88a982fd729f861a4439a59e632a7d76eb033991c437a2368bc2a834873f1f8a

    • SHA512

      cea75189109aab37974c7f57b7008c18755e362658ef47cfc093708fbe8b8ef06383458f898ebf11b1359b334980a70d18604a79265176d4773c3dfdfe4ab097

    • SSDEEP

      6144:jCeJW1DhGOWLpoLuVLhiade0Huq8PGMZW/d+2t7i+:/WJhGOWLpogLAa40+PGMZHe7l

    Score
    10/10
    xloaderpagiloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks