Overview

overview

10

Static

static

3

ZYJY-20210...21.exe

windows7-x64

10

ZYJY-20210...21.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    4a44628458993a9256535200ac0913ed_JaffaCakes118
  • Size 662KB
  • Sample241015-17rtpszepe
  • SHA256 9ee324f352cb42be67afad04bd0e3ed46521c98a75cb6043e96047137c326911
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderipa8discoveryloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • ipa8

Decoy

  • royalposhpups.com

  • univa.world

  • lanerbo.com

  • shopbabygo.com

  • theutahhomestore.com

  • serialmixer.icu

  • linfeiya.com

  • xn--12cg3de5c2eb5cyi.com

  • am-conseil-communication.com

  • dailygame168.com

  • therightmilitia.com

  • visions-agency.com

  • mapopi.com

  • frugallyketo.com

  • guapandglo.com

  • 54w-x126v.net

  • your-health-kick.com

  • blockchainhub360.com

  • registernowhd.xyz

  • votekellykitashima.com

Targets

    • Target
      ZYJY-2021010005.RXHT0021.exe
    • Size 882KB
    • SHA256 1f842cf49a031ad6112edf767d3022d47391b39fd3bda6e7c456f5815f8bf742
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderipa8discoveryloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks