Overview

overview

10

Static

static

3

f7e4da015c...18.exe

windows7-x64

10

f7e4da015c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f7e4da015c11e085e6f4e48b3dc2176d_JaffaCakes118

  • Size

    817KB

  • Sample

    240418-nkxefscg7w

  • MD5

    f7e4da015c11e085e6f4e48b3dc2176d

  • SHA1

    d52c29c80fb82f4774b7624d8a1d429aae69e8f3

  • SHA256

    9c667699c6643d42dd1264b3657141bf3b23b56f47e527e33ae83030d937cb5a

  • SHA512

    e062a9fe4f8caf24ae313101702d1bcc9bdb9aea7f1464b6323f83ace65abaa2e13740ecd74b676e5334a908525a876fd091792e415f1b049551a5804d34eebc

  • SSDEEP

    12288:HSeTwrmpRw3viRidw1G3lZBpqNFevbOEykaGKNR70ZJUt2NjFr:HSwJUf8E5pKFGbOEy70LUMNjR

Score
10/10
xloaderwufnloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

wufn

Decoy

rsautoluxe.com

theroseofsharonsalon.com

singnema.com

nathanielwhite108.com

theforumonline.com

iqpt.info

joneshondaservice.com

fafene.com

solanohomebuyerclass.com

zwq.xyz

searchlakeconroehomes.com

briative.com

frystmor.city

systemofyouth.com

sctsmney.com

tv-safetrading.com

thesweetboy.com

occulusblu.com

pawsthemomentpetphotography.com

travelstipsguide.com

Targets

    • Target

      f7e4da015c11e085e6f4e48b3dc2176d_JaffaCakes118

    • Size

      817KB

    • MD5

      f7e4da015c11e085e6f4e48b3dc2176d

    • SHA1

      d52c29c80fb82f4774b7624d8a1d429aae69e8f3

    • SHA256

      9c667699c6643d42dd1264b3657141bf3b23b56f47e527e33ae83030d937cb5a

    • SHA512

      e062a9fe4f8caf24ae313101702d1bcc9bdb9aea7f1464b6323f83ace65abaa2e13740ecd74b676e5334a908525a876fd091792e415f1b049551a5804d34eebc

    • SSDEEP

      12288:HSeTwrmpRw3viRidw1G3lZBpqNFevbOEykaGKNR70ZJUt2NjFr:HSwJUf8E5pKFGbOEy70LUMNjR

    Score
    10/10
    xloaderwufnloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks