Overview

overview

10

Static

static

3

81206806ca...18.exe

windows7-x64

10

81206806ca...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    81206806ca9526a7e21cc35a56e0c706_JaffaCakes118
  • Size 719KB
  • Sample240801-tgps4aybpm
  • SHA256 123a1e9fbf8447659da30d82c6c6c2b909f5b57ca8dcf83db930a4929e9ce4d7
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderuszndiscoveryloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • uszn

Decoy

  • animegriptape.com

  • pcpnetworks.com

  • putupmybabyforadoption.com

  • xn--jvrr98g37n88d.com

  • fertinvitro.doctor

  • undonethread.com

  • avoleague.com

  • sissysundays.com

  • guilhermeoliveiro.site

  • catholicon-bespeckle.info

  • mardesuenosfundacion.com

  • songkhoe24.site

  • shoecityindia.com

  • smallbathroomdecor.info

  • tskusa.com

  • prairiespringsllc.com

  • kegncoffee.com

  • clicklounge.xyz

  • catholicendoflifeplanning.com

  • steelobzee.com

Targets

    • Target
      81206806ca9526a7e21cc35a56e0c706_JaffaCakes118
    • Size 719KB
    • SHA256 123a1e9fbf8447659da30d82c6c6c2b909f5b57ca8dcf83db930a4929e9ce4d7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderuszndiscoveryloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks