Overview

overview

10

Static

static

3

e2aed402a9...18.exe

windows7-x64

10

e2aed402a9...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    e2aed402a91f870f2d9caf0da11b8efe_JaffaCakes118
  • Size 501KB
  • Sample240915-rnaxeaxcpb
  • SHA256 81868cc802535d46ef3098d7eab8cd3d40ca6e2770e6907a64927506ca43660b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderp980discoveryloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.1

Campaign

  • p980

Decoy

  • iwantgoddessevelyn.com

  • attorneysiraq.com

  • stfairytale-gakuin.site

  • mybazaartrip.com

  • alexjrtransport.com

  • present-sense.store

  • bigbucks4you.com

  • westernwings.info

  • qrs4u.com

  • knightsbridgehouse.com

  • fanamfoods.com

  • ediblesareincredible.com

  • revinedbypao.com

  • psychsolutionsofdurham.com

  • xn--mykyr-kra.com

  • sweettreatsepiceats.com

  • quarnetta.com

  • femaletopic.com

  • rockstoneofblue.com

  • btbaidu.com

Targets

    • Target
      e2aed402a91f870f2d9caf0da11b8efe_JaffaCakes118
    • Size 501KB
    • SHA256 81868cc802535d46ef3098d7eab8cd3d40ca6e2770e6907a64927506ca43660b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderp980discoveryloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks