Overview

overview

10

Static

static

3

fdb8b9c805...18.exe

windows7-x64

10

fdb8b9c805...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fdb8b9c8056a552461e493d3f1b4b2d8_JaffaCakes118

  • Size

    253KB

  • Sample

    240420-1n3rvsbd51

  • MD5

    fdb8b9c8056a552461e493d3f1b4b2d8

  • SHA1

    87ea5998b4f6831c99bdce8cd48d3c238833d2c7

  • SHA256

    e33f9dbf56b2850d44ff3f6dff7b0631abbc52836b97cc41c4e4907538ed749a

  • SHA512

    59217111d51a555867dac4df8e3e609706d671d1802f8c70daad3f913965dcb10cca6d878a3963e1aff7527628c7392de6b95fbf72564227a1d0b8ddea99a1b9

  • SSDEEP

    6144:bd53TvpHeIl0SQCoocCvKrcIxJYAsXfpuUVbbNGw411hwpXHRqjoEt60R0bAM:bd53TvpHeIl0SVoA83YAAuUV/AHhQgPu

Score
10/10
xloaderum8eloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

um8e

Decoy

theypretend.com

hopeschildren.com

kuly.cloud

maniflexx.net

bedtimesocietyblog.com

spenglerwetlandpreserve.com

unity-play.net

bonap56.com

consciencevc.com

deluxeluxe.com

officialjuliep.com

cttrade.club

quietflyt.com

mcabspl.com

lippocaritahotel.com

tolanfilms.xyz

momenaagro.com

slingshotart.com

thefoundershuddle.com

mobilbaris.com

Targets

    • Target

      fdb8b9c8056a552461e493d3f1b4b2d8_JaffaCakes118

    • Size

      253KB

    • MD5

      fdb8b9c8056a552461e493d3f1b4b2d8

    • SHA1

      87ea5998b4f6831c99bdce8cd48d3c238833d2c7

    • SHA256

      e33f9dbf56b2850d44ff3f6dff7b0631abbc52836b97cc41c4e4907538ed749a

    • SHA512

      59217111d51a555867dac4df8e3e609706d671d1802f8c70daad3f913965dcb10cca6d878a3963e1aff7527628c7392de6b95fbf72564227a1d0b8ddea99a1b9

    • SSDEEP

      6144:bd53TvpHeIl0SQCoocCvKrcIxJYAsXfpuUVbbNGw411hwpXHRqjoEt60R0bAM:bd53TvpHeIl0SVoA83YAAuUV/AHhQgPu

    Score
    10/10
    xloaderum8eloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks