xloader

General

Target

ce877088e8ee801231a24207267d7beb_JaffaCakes118
Size

882KB
Sample

241206-xmxbxa1rex
MD5

ce877088e8ee801231a24207267d7beb
SHA1

735926def0efdd6123fb5e6dd28b37e81e44fd91
SHA256

1f842cf49a031ad6112edf767d3022d47391b39fd3bda6e7c456f5815f8bf742
SHA512

20174dcf5a9e6ce2bbcb50c39e50886fe5ee90c915b79a501126d175e12fe75de5f48b90c0dfb5cb3566b2510a8fdb0039a75a7cdd56f672293ecb7a52e9e665
SSDEEP

12288:ZSD19TejCYDeeWAHcIActYY6Sr336nWpIQNe6crQbwUfecvxpOZTHK7zVzKboASR:EDDKjv63AkTSb36YIJUf3xprFKboF

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ipa8

Decoy

royalposhpups.com

univa.world

lanerbo.com

shopbabygo.com

theutahhomestore.com

serialmixer.icu

linfeiya.com

xn--12cg3de5c2eb5cyi.com

am-conseil-communication.com

dailygame168.com

therightmilitia.com

visions-agency.com

mapopi.com

frugallyketo.com

guapandglo.com

54w-x126v.net

your-health-kick.com

blockchainhub360.com

registernowhd.xyz

votekellykitashima.com

Targets

- Target
  
  ce877088e8ee801231a24207267d7beb_JaffaCakes118
- Size
  
  882KB
- MD5
  
  ce877088e8ee801231a24207267d7beb
- SHA1
  
  735926def0efdd6123fb5e6dd28b37e81e44fd91
- SHA256
  
  1f842cf49a031ad6112edf767d3022d47391b39fd3bda6e7c456f5815f8bf742
- SHA512
  
  20174dcf5a9e6ce2bbcb50c39e50886fe5ee90c915b79a501126d175e12fe75de5f48b90c0dfb5cb3566b2510a8fdb0039a75a7cdd56f672293ecb7a52e9e665
- SSDEEP
  
  12288:ZSD19TejCYDeeWAHcIActYY6Sr336nWpIQNe6crQbwUfecvxpOZTHK7zVzKboASR:EDDKjv63AkTSb36YIJUf3xprFKboF
Score

10^/10

discovery xloader ipa8 loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader family
  xloader
- Xloader payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader family

Xloader payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2