Overview

overview

10

Static

static

3

81285772ca...18.exe

windows7-x64

10

81285772ca...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    81285772ca6597218d42e3c301ec38c1_JaffaCakes118

  • Size

    1.4MB

  • Sample

    241031-cnzs7sxcpf

  • MD5

    81285772ca6597218d42e3c301ec38c1

  • SHA1

    75f8d57a46a7390d7a7004c93ad006192e5c748b

  • SHA256

    681986a550ac1bba8275516742b4589a7069f823e1b9902df466831d043e6a2b

  • SHA512

    04f84cfdfcd448d4b6985e8649d88c2e50aebeac95a29f0eb8fcf801119d288a52ab14574e6ecbd1738e3463ad6b95a4e13e0002962105d1339ec2cb06ba0897

  • SSDEEP

    24576:nBt9siOEQMIBC1cmti+VEupmGBqT2fXyvOi:OevIrGbyDT2/

Score
10/10
xloaderp2iodiscoveryloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

p2io

Decoy

essentiallyourscandles.com

cleanxcare.com

bigplatesmallwallet.com

iotcloud.technology

dmgt4m2g8y2uh.net

malcorinmobiliaria.com

thriveglucose.com

fuhaitongxin.com

magetu.info

pyithuhluttaw.net

myfavbutik.com

xzklrhy.com

anewdistraction.com

mercuryaid.net

thesoulrevitalist.com

swayam-moj.com

liminaltechnology.com

lucytime.com

alfenas.info

carmelodesign.com

Targets

    • Target

      81285772ca6597218d42e3c301ec38c1_JaffaCakes118

    • Size

      1.4MB

    • MD5

      81285772ca6597218d42e3c301ec38c1

    • SHA1

      75f8d57a46a7390d7a7004c93ad006192e5c748b

    • SHA256

      681986a550ac1bba8275516742b4589a7069f823e1b9902df466831d043e6a2b

    • SHA512

      04f84cfdfcd448d4b6985e8649d88c2e50aebeac95a29f0eb8fcf801119d288a52ab14574e6ecbd1738e3463ad6b95a4e13e0002962105d1339ec2cb06ba0897

    • SSDEEP

      24576:nBt9siOEQMIBC1cmti+VEupmGBqT2fXyvOi:OevIrGbyDT2/

    Score
    10/10
    xloaderp2iodiscoveryloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader family

      xloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks