Overview

overview

10

Static

static

3

59d153e8d5...18.exe

windows7-x64

10

59d153e8d5...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    59d153e8d573533a302a23a00171ce27_JaffaCakes118
  • Size 601KB
  • Sample240719-bbdvjaybje
  • SHA256 e393b4fb7fdbf21f1455f58a7f7c94dd809b05563bc5a6e8f7a9ac62e96a1df4
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderim9nloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • im9n

Decoy

  • amythystbyashley.com

  • vaxxedfr.com

  • satucunghoada.com

  • bringmystorage.com

  • akapamata.com

  • primeworldgroup.com

  • aninda.tech

  • soundfoamguys.com

  • sakura.services

  • theglobalconversations.com

  • cafe-genova.com

  • diffuse-expected.com

  • didakticalaboratorios.com

  • plantsenliving.com

  • designdtc.com

  • uibizz.com

  • safficient.com

  • agrahotelbooking.com

  • money-back-financial.com

  • fatr555.icu

Targets

    • Target
      59d153e8d573533a302a23a00171ce27_JaffaCakes118
    • Size 601KB
    • SHA256 e393b4fb7fdbf21f1455f58a7f7c94dd809b05563bc5a6e8f7a9ac62e96a1df4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderim9nloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks