Overview

overview

10

Static

static

3

fda0d823b2...18.exe

windows7-x64

10

fda0d823b2...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fda0d823b262ac2b1bd76a2053c29692_JaffaCakes118

  • Size

    466KB

  • Sample

    240420-zqw7eshg35

  • MD5

    fda0d823b262ac2b1bd76a2053c29692

  • SHA1

    73f72d7c987d44d1f236c138c5617b527c5ba340

  • SHA256

    91a166f9a29ad832c9640078210a47e5afa928ab1a79a7b40d3b358e9c8bc5d5

  • SHA512

    230e3a12c58a61c2348463b5acb92a6b557419b79e0427882750caa84d3c7e8fcec92ff6151f4f22b6eb967da138c931ed56f0dedadf1af1ac5d809508e74507

  • SSDEEP

    12288:AsXSBAmUT9BbRsXFkN8xDqT2LWWJOxTa:AsCBAme9Bb2Xq8xk2LWx

Score
10/10
xloaderfqiqloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

fqiq

Decoy

driventow.com

ipatchwork.today

bolder.equipment

seal-brother.com

mountlaketerraceapartments.com

weeden.xyz

sanlifalan.com

athafood.com

isshinn1.com

creationslazzaroni.com

eclecticrenaissancewoman.com

satellitephonstore.com

cotchildcare.com

yamacorp.digital

ff4cuno43.xyz

quicksticks.community

govindfinance.com

farmersfirstseed.com

megacinema.club

tablescaperendezvous4two.com

Targets

    • Target

      fda0d823b262ac2b1bd76a2053c29692_JaffaCakes118

    • Size

      466KB

    • MD5

      fda0d823b262ac2b1bd76a2053c29692

    • SHA1

      73f72d7c987d44d1f236c138c5617b527c5ba340

    • SHA256

      91a166f9a29ad832c9640078210a47e5afa928ab1a79a7b40d3b358e9c8bc5d5

    • SHA512

      230e3a12c58a61c2348463b5acb92a6b557419b79e0427882750caa84d3c7e8fcec92ff6151f4f22b6eb967da138c931ed56f0dedadf1af1ac5d809508e74507

    • SSDEEP

      12288:AsXSBAmUT9BbRsXFkN8xDqT2LWWJOxTa:AsCBAme9Bb2Xq8xk2LWx

    Score
    10/10
    xloaderfqiqloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks