Overview

overview

10

Static

static

3

39c29125a8...28.exe

windows7-x64

10

39c29125a8...28.exe

windows10-2004-x64

7

$PLUGINSDI...zi.dll

windows7-x64

10

$PLUGINSDI...zi.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_660d63fb00fa5f47737a5b22014f8bdf22080722ac16da61216caa5e99210b65

  • Size

    239KB

  • Sample

    241223-3qjg4svpc1

  • MD5

    a26306c550e3c94a60f919f9ec86e054

  • SHA1

    c591d738622b68def0916d37acaa82c6fa2b7c9d

  • SHA256

    660d63fb00fa5f47737a5b22014f8bdf22080722ac16da61216caa5e99210b65

  • SHA512

    ff65d51139ba2aa20a853043321073a519b89c4f723dd5e171e9458c90be908484b0a26f14e61ef25d646cbff51d6b44b34f3716368aefdcfcec0646d7cdb6f9

  • SSDEEP

    6144:vuYwFuK9EpZVmF8uQDwoqiu+M95WiAvvXKbGU:G59kVTuQ8oqL+U96CbGU

Score
10/10
xloaderuar3discoveryloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

uar3

Decoy

sgadvocats.com

mjscannabus.com

hilldaley.com

ksdollhouse.com

hotgiftboutique.com

purebloodsmeet.com

relaunched.info

cap-glove.com

productcollection.store

fulikyy.xyz

remoteaviationjobs.com

bestcleancrystal.com

virtualorganizationpartner.com

bookgocar.com

hattuafhv.quest

makonigroup.com

officecom-myaccount.com

malgorzata-lac.com

e-learningeducators.com

hygilaur.com

Targets

    • Target

      39c29125a8c776bd6eed886f346804a23d518b77_1643743531128.bin

    • Size

      251KB

    • MD5

      130dc13fcd533d00374ef50177d8c54c

    • SHA1

      39c29125a8c776bd6eed886f346804a23d518b77

    • SHA256

      5614fc852594749ecfbc1f741c9a2ad20edce64652a5c422ed4ca7c5943184a7

    • SHA512

      2fce01506706dc9409ed2a231b43c439f76d86e921b7f51c8ba9fc8a044d1004dcce6c0beeda4ec4fcbf15f1df36160073ced6db7916228a5be2512205aa8587

    • SSDEEP

      6144:ownzthvTfFMFvH+RhBCTZQdENPrPe6VgyE0XeZu8/Y:TzHTeF+rY6yNK6SyBsY

    Score
    10/10
    xloaderuar3discoveryloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader family

      xloader

    • Xloader payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/rrkssezi.dll

    • Size

      20KB

    • MD5

      0b9de97b386a1a82cee5d3e059b7ec9b

    • SHA1

      cc730fba70941afa39a9827fea215c9f099a6d01

    • SHA256

      ad29dd53baa1e19fe4cacd99b9dea3b6e7fba8c6d89fe0492244de4414948e21

    • SHA512

      b36cef8eb5fdf990ed79fd718a250e6f736e585516b4cfc97b7a0aba6f254e8997d8cf0262b0f4a894dc91e13c2b22aaa1eac554c2e23c42e50e8bc2fae3ad3d

    • SSDEEP

      384:cYwn4GqWlh1i9E8LB2T35YjzYDYp0fRBtsoudoq0HNyp:7wnskhU6tTuYkpoudohy

    Score
    10/10
    xloaderuar3discoveryloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader family

      xloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks