Overview

overview

10

Static

static

3

f502c1a5b6...18.exe

windows7-x64

10

f502c1a5b6...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f502c1a5b642c38455fe94ca3ce2eed8_JaffaCakes118
  • Size 321KB
  • Sample240925-dcevbs1blk
  • SHA256 4f458d13d054cb8e9cb734d6929fe65b59b2a25e2c460af1fc788ca490118a85
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloadero8nadiscoveryloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • o8na

Decoy

  • www1669099.com

  • digitalallserv.com

  • thiszzzwq.info

  • dallasoswalt.info

  • ladolcefesta.com

  • mariamalikially.com

  • origenbsas.com

  • antichoc.watch

  • tropicalbirdtoys.com

  • bbluedotvrwdbuy.com

  • racevx.xyz

  • ut-trustandwill.com

  • maximumhomeoffers.com

  • wrapname.com

  • hypelighystrip.com

  • oshoum2020.com

  • parkwestmi.com

  • themodumall.com

  • tempuslawnandsnow.com

  • dailypromo.xyz

Targets

    • Target
      f502c1a5b642c38455fe94ca3ce2eed8_JaffaCakes118
    • Size 321KB
    • SHA256 4f458d13d054cb8e9cb734d6929fe65b59b2a25e2c460af1fc788ca490118a85
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloadero8nadiscoveryloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks