Overview

overview

10

Static

static

3

9f1a5e5c6a...18.exe

windows7-x64

10

9f1a5e5c6a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118

  • Size

    425KB

  • Sample

    240611-wtymwawenj

  • MD5

    9f1a5e5c6a5c5493459010d43af8f504

  • SHA1

    56ed32addbac6dd6f1fe2ddfb4add70c04a1596d

  • SHA256

    652ed909a2087f6e3eeec91c002f66d4f9256e809439d2e081031e0776803e6c

  • SHA512

    5a2b2077abb729fd4f186a81e6941b04dc59c7b1a4173ffd1db8aea4c9d9e7a628958ff577bc46b85cba3ca597642c766c85f83670bc1fc5345616930baa3fe1

  • SSDEEP

    12288:wHFZ2iNHv2zv1gt1jnqgS7+QkNdlVR81TasQw8Mgy:41c2tpnc7Md/R893V8Mgy

Score
10/10
xloaderpzbaloaderrat

Malware Config

Extracted

Family

xloader

Version

2.1

Campaign

pzba

Decoy

cafeblanca.net

goodvibrationswindchimes.com

mydmapp.com

isabelpasadaspsicologa.com

adonustmuseum.com

oghomeinfoa18.club

asia-ivoyage.com

chargegamehair.com

78500802.xyz

siteoficialcliqueagora.com

kanchanspice.com

elysalesgh.com

zbarrier.com

mariedietze.fyi

ppope.com

bluechipsgroup.company

mineola.education

covkpbac.icu

bettercityhomes.com

elevenlevels.com

Targets

    • Target

      9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118

    • Size

      425KB

    • MD5

      9f1a5e5c6a5c5493459010d43af8f504

    • SHA1

      56ed32addbac6dd6f1fe2ddfb4add70c04a1596d

    • SHA256

      652ed909a2087f6e3eeec91c002f66d4f9256e809439d2e081031e0776803e6c

    • SHA512

      5a2b2077abb729fd4f186a81e6941b04dc59c7b1a4173ffd1db8aea4c9d9e7a628958ff577bc46b85cba3ca597642c766c85f83670bc1fc5345616930baa3fe1

    • SSDEEP

      12288:wHFZ2iNHv2zv1gt1jnqgS7+QkNdlVR81TasQw8Mgy:41c2tpnc7Md/R893V8Mgy

    Score
    10/10
    xloaderpzbaloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks