General

  • Target

    0c377447f098f43601e8c21609c41e1c_JaffaCakes118

  • Size

    228KB

  • Sample

    241002-yf49lsxbka

  • MD5

    0c377447f098f43601e8c21609c41e1c

  • SHA1

    8da17dacc87338c630430071efe7850ef34c0184

  • SHA256

    3adaa1111196714a172b66f0deb9013f5b86c1671a7d126b69703d64e358f624

  • SHA512

    b8746e95f87b7e948db46d4270ee10dc9a6fa1ef9e97defeda2a27053523928c9e8c79371799c2eb48569ca4f983801e15fd476de1a15f2b5c7e65703d32fdb0

  • SSDEEP

    3072:/6HGteVUP/qOu43gC4S9HbJhElye1x8JtVTrrTlznlAPOwJFnS1mekUZPPRkTRKF:/dQOJu4wC3tfVSQnl6JFnom3UtPSTRSL

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ieqo

Decoy

new-post-25782.xyz

podcastrrr.com

babyspageelong.com

boaddeo.club

distribuzionemedica.com

peaceofminderbinder.com

abbyrosemusic.com

odessawildliferemoval.com

prosperasight.com

liibbyapp.com

shandaferguson.com

kirsehiryenihaber.com

secured07b-chase.com

leanonmelifeadvice.com

securemtgs.com

temgk255.space

lunasparallevar.com

transportesdario.com

redwork.club

directopolis.com

Targets

    • Target

      0c377447f098f43601e8c21609c41e1c_JaffaCakes118

    • Size

      228KB

    • MD5

      0c377447f098f43601e8c21609c41e1c

    • SHA1

      8da17dacc87338c630430071efe7850ef34c0184

    • SHA256

      3adaa1111196714a172b66f0deb9013f5b86c1671a7d126b69703d64e358f624

    • SHA512

      b8746e95f87b7e948db46d4270ee10dc9a6fa1ef9e97defeda2a27053523928c9e8c79371799c2eb48569ca4f983801e15fd476de1a15f2b5c7e65703d32fdb0

    • SSDEEP

      3072:/6HGteVUP/qOu43gC4S9HbJhElye1x8JtVTrrTlznlAPOwJFnS1mekUZPPRkTRKF:/dQOJu4wC3tfVSQnl6JFnom3UtPSTRSL

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks