Overview

overview

10

Static

static

3

59473d97c6...18.exe

windows7-x64

10

59473d97c6...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    59473d97c6132afa71a39b344ff06aea_JaffaCakes118

  • Size

    532KB

  • Sample

    240718-13w8masbpe

  • MD5

    59473d97c6132afa71a39b344ff06aea

  • SHA1

    c1bba8e127963ea5dfc24dd43854d5cee5f398bb

  • SHA256

    039530482798b483906f0308ed0b4e408f1c747a24680ed8dde1a850b08cc887

  • SHA512

    16f5f32285cd604c1acb3db43e5e340f00561235ca4ed830462b41a324b1db4c01e6bf77e6758c683a8868c2c9e2adec9af1df972fb3c56bab2027eaa2a46ae5

  • SSDEEP

    12288:8Io8jRtlAevDpdEeR9s31nOrPhWXEy9NDN8w:8I7RpddEegFn2P/ip8w

Score
10/10
xloadern6beloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

n6be

Decoy

earth-service.net

travellucian.com

directregelen-nl-nl.icu

nnpec.com

limaslandscaping.com

solmep.info

ncnxjk.com

hegujoc.xyz

4-artists.net

wonderifthisworks.xyz

littlecreekacresri.com

theledgym.com

bmgassist.com

aidatimdenizimden.com

shozblog.com

compassionatecuddling.com

rockycellularllc.com

uberautos247.com

jedoethetzelf.online

6865321.com

Targets

    • Target

      59473d97c6132afa71a39b344ff06aea_JaffaCakes118

    • Size

      532KB

    • MD5

      59473d97c6132afa71a39b344ff06aea

    • SHA1

      c1bba8e127963ea5dfc24dd43854d5cee5f398bb

    • SHA256

      039530482798b483906f0308ed0b4e408f1c747a24680ed8dde1a850b08cc887

    • SHA512

      16f5f32285cd604c1acb3db43e5e340f00561235ca4ed830462b41a324b1db4c01e6bf77e6758c683a8868c2c9e2adec9af1df972fb3c56bab2027eaa2a46ae5

    • SSDEEP

      12288:8Io8jRtlAevDpdEeR9s31nOrPhWXEy9NDN8w:8I7RpddEegFn2P/ip8w

    Score
    10/10
    xloadern6beloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks