Overview

overview

10

Static

static

3

AgroAG0080...df.exe

windows7-x64

10

AgroAG0080...df.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

ncvh5f0cmlhy.dll

windows7-x64

1

ncvh5f0cmlhy.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    227d089d316118c019d58bc4cc4b00d3_JaffaCakes118

  • Size

    358KB

  • Sample

    240703-qk8htsxgja

  • MD5

    227d089d316118c019d58bc4cc4b00d3

  • SHA1

    e16adc9cc14a91b74932f1efff607359d74b038e

  • SHA256

    80e9dba66f17d667abcec87377d1cf5529eefec5b6d449663860abcfb443ef70

  • SHA512

    29341cd818fd10cc3159f1056d41de2a5e8bdfc0694c7e1946f018fb33a60f32155fe30bda697fad064a0005756bcd89e3d198e98fae8b08f5eca0d5824421e1

  • SSDEEP

    6144:Tx/MjiVFI8EXfPGUN237w78+0JSuYWuvXIqQeMjXSV:p1o8EX2Uw3UY1JkhTQeMD

Score
10/10
xloadergzcjloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

gzcj

Decoy

localzhops.com

cfsb114.com

sweetiefilms.com

cyclewatts.com

bubblesportsevent.com

halloween-r-us.com

rcdzsm.com

reelatioens.com

uniquegranitebenefits.com

chainlinkdex.com

topcoolhlist.com

ivy-apps.com

shopmajesticqueendom.com

ddiesels.com

ventajuguetessexuales.online

daylight93245.com

heiyingxitong.com

personalfashion.guru

usadrugfree.com

beyondcareersuccess.com

Targets

    • Target

      AgroAG008021921doc_pdf.exe

    • Size

      296KB

    • MD5

      8c17ba485d997f4613ae37d2ae89d724

    • SHA1

      910883faa1ea6c99da8e26e44e3a9b29a6b21021

    • SHA256

      c1fa41f10a15d258d2edf7c06648ad2413ca25d7e2b4de2b45acfde204b1cf45

    • SHA512

      36a771bdfa3657a2bd606707267ef442a84cfb236d548efe189049aa2f3656b3a0f70289653ce49b885240ab081c68cbd17ba0c3c6e019e9086b10a4896ee8f6

    • SSDEEP

      6144:2x/MjiVFI8EXfPGUN237w78+0JSuYWuvXIqQeMjXSVE:K1o8EX2Uw3UY1JkhTQeMDJ

    Score
    10/10
    xloadergzcjloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      fccff8cb7a1067e23fd2e2b63971a8e1

    • SHA1

      30e2a9e137c1223a78a0f7b0bf96a1c361976d91

    • SHA256

      6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

    • SHA512

      f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

    • SSDEEP

      192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4

    Score
    3/10
    behavioral3behavioral4

    • Target

      ncvh5f0cmlhy.dll

    • Size

      10KB

    • MD5

      69d7a8b09151eed513bb240305f08c1b

    • SHA1

      9de884849a301ad036c2491246cde2157e2f63b1

    • SHA256

      c237c5d665f8fd074c3d2cbbe2da7751f5841ba56be8d103abf86a07bdd961e9

    • SHA512

      b6a4011cef892dff62a9a40aa035f6cf749750962e61d30dd754fc4e268587cbe87a92cb3e218b4fe50baebbba9aa2d7c2bfecc172dc13ef66cdb18576c90f62

    • SSDEEP

      192:NHW20d6aoi4FsFKwzwCAjHZgXWn2jbqEX5RXPFz4TqgRJFBPqO:xm6tUiZfn23q+5RXNEGgRTd

    Score
    3/10
    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v13

Tasks