Overview

overview

10

Static

static

3

bnh.exe

windows7-x64

3

bnh.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    56bb9a9db5f392d8c7614ab4b3537951_JaffaCakes118
  • Size 390KB
  • Sample241018-lprzessemj
  • SHA256 ff233af2187a5aee8d3911360eef243367c505348b896473cadb76e077d44646
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloadern066discoveryloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • n066

Decoy

  • elsegundonewhaven.com

  • miiways.com

  • tripledstones.com

  • innerworkshop.vision

  • kirkgun.com

  • vivabienrealty.com

  • estudiopedroleon.com

  • joannebuyproperty.com

  • top3wireless.com

  • kureex.com

  • theselfieplug.com

  • citymobileofficial.com

  • latestgrants.com

  • atomicstream.com

  • campingds.com

  • lesphere.com

  • kgeorgiades.com

  • nicktrigili.com

  • whds60w.com

  • nutricookinternational.com

Targets

    • Target
      bnh.exe
    • Size 614KB
    • SHA256 1a55fa78a001127ab3e53317fc29487b57343034496594949610a78191156519
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryxloadern066loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks