Overview

overview

10

Static

static

3

c18be7f1ac...18.exe

windows7-x64

10

c18be7f1ac...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c18be7f1acc1b2b3f8626040c6dc7c91_JaffaCakes118

  • Size

    386KB

  • Sample

    241204-jmcevayjfx

  • MD5

    c18be7f1acc1b2b3f8626040c6dc7c91

  • SHA1

    7427ba05e41a38e15c8d1299f3379e2454244c3c

  • SHA256

    24b95d63fe3c224c1ce3c814675da3c06469c805bb6158520f1a9014e63a4af2

  • SHA512

    3a1c9d25209be5f2e165059007cdf3e4fbdc96246debcafb520a84142830cca32dec06e0cff9a49c46e4c5b1eeb3098802b0ed81728849df198d03eef93bbfd5

  • SSDEEP

    6144:Ly9PP44xVZOdH25KRhTz3ipwFUObul7x3nE+IZ8Nq:OlOdE4nypcU33EMNq

Score
10/10
xloaderma5cdiscoveryloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ma5c

Decoy

hua0591.com

ncuedu.icu

damaramtv.com

mgnmx.com

fridaynightdates.com

lyqjzg.net

americanalecompany.com

badgebuttons.com

maiketplace.com

camsa90.com

certifiedrockets.com

mixmarkt.delivery

htownxtracts.com

bluemountainautoparts.com

aldemallc.com

joint-sisters.com

gertimi.com

s293a8tx4zu.net

healthy-calm.com

bulukx.com

Targets

    • Target

      c18be7f1acc1b2b3f8626040c6dc7c91_JaffaCakes118

    • Size

      386KB

    • MD5

      c18be7f1acc1b2b3f8626040c6dc7c91

    • SHA1

      7427ba05e41a38e15c8d1299f3379e2454244c3c

    • SHA256

      24b95d63fe3c224c1ce3c814675da3c06469c805bb6158520f1a9014e63a4af2

    • SHA512

      3a1c9d25209be5f2e165059007cdf3e4fbdc96246debcafb520a84142830cca32dec06e0cff9a49c46e4c5b1eeb3098802b0ed81728849df198d03eef93bbfd5

    • SSDEEP

      6144:Ly9PP44xVZOdH25KRhTz3ipwFUObul7x3nE+IZ8Nq:OlOdE4nypcU33EMNq

    Score
    10/10
    xloaderma5cdiscoveryloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader family

      xloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks