Overview

overview

10

Static

static

3

f866a06214...18.exe

windows7-x64

10

f866a06214...18.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    f866a06214ff680e7d9f586a8d6a84f5_JaffaCakes118
  • Size 694KB
  • Sample240418-vjdpaaab23
  • SHA256 39fc8ada09fdee11dac8fbb0236624c2d5dcf2b66d8f2aa4bbcdeada6de6206b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderusvrloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • usvr

Decoy

  • theblockmeatstore.com

  • drone-moment.com

  • srsfashionbd.com

  • kylayagerartwork.com

  • instagrams.tools

  • rosenwealth.com

  • indicraftsvilla.com

  • rswizard.com

  • irist.one

  • pubgclaimx14.com

  • thegeorgiahomefinder.com

  • unusualdog.com

  • kifayatikart.com

  • methodunit.net

  • bavarian-luxury.com

  • 17391000.com

  • ipcsaveday.com

  • yael-b.com

  • pasionqueconecta.com

  • youngsvideography.com

Targets

    • Target
      f866a06214ff680e7d9f586a8d6a84f5_JaffaCakes118
    • Size 694KB
    • SHA256 39fc8ada09fdee11dac8fbb0236624c2d5dcf2b66d8f2aa4bbcdeada6de6206b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderusvrloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks