Overview

overview

10

Static

static

3

085f6796a7...18.exe

windows7-x64

10

085f6796a7...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    085f6796a761a1f1dd252ef348f2fe69_JaffaCakes118

  • Size

    478KB

  • Sample

    240624-n5eedavbkj

  • MD5

    085f6796a761a1f1dd252ef348f2fe69

  • SHA1

    9abd15c6bc542b0bd8baa79f90540dd7f1f80af1

  • SHA256

    b0787f51caf44390126cfb1e827d548139021e30bca2cf2e299917ea5788a8bf

  • SHA512

    80ca49f471e3b53890869e4be0cfae82ce12367ce20b5436a5daa8c886f7e14f11b2de402ae714f53ac362b730a1fb104d981e99ab186b795e24ae8da4d2131f

  • SSDEEP

    12288:Xd9ozJLSibqU65lOAVQsuCwBivjcK95u1t09b:LozlSDUiVQsVaIF

Score
10/10
xloaderuidrloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

uidr

Decoy

dulichsongcham.com

cash-royal.com

geneseewildlifetrapping.com

9cc9x79m3y2.com

ntjjzx.com

joinglooko.com

upmchealhtrak.com

hookandcask.com

orca-web.com

ag3holdings.com

empoweredinvestmentstx.com

lustywall.com

rcpelaurentides.com

goyalcoorchidnirvanatwo.homes

iotajinn.com

littlemlive.com

hippocratesbio.com

ashleysema.design

175a45.xyz

bpocompaniesphilippines.com

Targets

    • Target

      085f6796a761a1f1dd252ef348f2fe69_JaffaCakes118

    • Size

      478KB

    • MD5

      085f6796a761a1f1dd252ef348f2fe69

    • SHA1

      9abd15c6bc542b0bd8baa79f90540dd7f1f80af1

    • SHA256

      b0787f51caf44390126cfb1e827d548139021e30bca2cf2e299917ea5788a8bf

    • SHA512

      80ca49f471e3b53890869e4be0cfae82ce12367ce20b5436a5daa8c886f7e14f11b2de402ae714f53ac362b730a1fb104d981e99ab186b795e24ae8da4d2131f

    • SSDEEP

      12288:Xd9ozJLSibqU65lOAVQsuCwBivjcK95u1t09b:LozlSDUiVQsVaIF

    Score
    10/10
    xloaderuidrloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks