Overview

overview

10

Static

static

3

07c99ae811...18.exe

windows7-x64

10

07c99ae811...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07c99ae811a2c467a1a2677faabf7cd5_JaffaCakes118

  • Size

    847KB

  • Sample

    240624-lr5y3azaqj

  • MD5

    07c99ae811a2c467a1a2677faabf7cd5

  • SHA1

    5443cfc115615e2af5a1e98edc6ea0f6372fd5b8

  • SHA256

    a6c85b5033ddf405500fef8230c295b94da31e866755b5f58901b89853af1419

  • SHA512

    24b393771cb75748469a1408b43009afd9998c0ac76093786305feb8a5da45f78e5193da2d0d4badc298160871c1aa08180295d1a8ff5bcaaab2c047a5a4cf56

  • SSDEEP

    12288:46VMjOZnxsnIcXpN0j0jmWBJElTVte9lvcTkt6X1LWqtD2biwzIJY:46V3nxsYcux49lGk2LWqhuL

Score
10/10
xloaderianvloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ianv

Decoy

toysclass.com

baohiemthuduc.com

dronesracers.com

wallis-platform.com

waltermorgan.fitness

vsn-designs.com

cengjing.life

trackcatologueorders.com

newworkpay.com

brainywoodindia.com

myrtlebeachstripperstoyou.com

saori.cloud

10fastvpn.com

freemindsweden.com

phatsquares.com

pandemia.tienda

7560eads6.com

sabjidada.com

zhyingj.group

nailmanicurest.com

Targets

    • Target

      07c99ae811a2c467a1a2677faabf7cd5_JaffaCakes118

    • Size

      847KB

    • MD5

      07c99ae811a2c467a1a2677faabf7cd5

    • SHA1

      5443cfc115615e2af5a1e98edc6ea0f6372fd5b8

    • SHA256

      a6c85b5033ddf405500fef8230c295b94da31e866755b5f58901b89853af1419

    • SHA512

      24b393771cb75748469a1408b43009afd9998c0ac76093786305feb8a5da45f78e5193da2d0d4badc298160871c1aa08180295d1a8ff5bcaaab2c047a5a4cf56

    • SSDEEP

      12288:46VMjOZnxsnIcXpN0j0jmWBJElTVte9lvcTkt6X1LWqtD2biwzIJY:46V3nxsYcux49lGk2LWqhuL

    Score
    10/10
    xloaderianvloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks