Overview

overview

10

Static

static

3

JaffaCakes...24.exe

windows7-x64

10

JaffaCakes...24.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_108d9f901a58b91dea720c89bdaf6424

  • Size

    494KB

  • Sample

    241231-k6r53swkdm

  • MD5

    108d9f901a58b91dea720c89bdaf6424

  • SHA1

    27c84fd7da3576f056d3c216cc1602839b6afaa4

  • SHA256

    7ec1e15224d90dfaf4898e771aa9997de11ad6794dce01f6c7d8b8cf479eb0fa

  • SHA512

    e33be9e7465239f07ffadf9439abe8d12aacab55587f8cf8a7f3e8fa0d64bb76abcfc5b71dbfc7710b871b55145292d6cff89d827e96d413f66d33d7d9b8555d

  • SSDEEP

    12288:zIwKYKwWHGKS8R2jLmgyKlIPoI6sG7I9LKpOjSSbwUw:ZeGtXDyRP6JF7

Score
10/10
xloadercuigdiscoveryloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

cuig

Decoy

sofiathinks-elderly.net

lahamicoast.info

2shengman.com

cbsautoplex.com

arcana-candles.com

genrage.com

kukumiou.xyz

thequizerking.com

sonataproductions.com

rebuildgomnmf.xyz

ubcoin.store

yiyouxue.net

firstlifehome.com

mdx-inc.net

gotbn-c01.com

dinobrindes.store

jcm-iso.com

cliente-mais.com

mloujewelry.com

correoversoi.quest

Targets

    • Target

      JaffaCakes118_108d9f901a58b91dea720c89bdaf6424

    • Size

      494KB

    • MD5

      108d9f901a58b91dea720c89bdaf6424

    • SHA1

      27c84fd7da3576f056d3c216cc1602839b6afaa4

    • SHA256

      7ec1e15224d90dfaf4898e771aa9997de11ad6794dce01f6c7d8b8cf479eb0fa

    • SHA512

      e33be9e7465239f07ffadf9439abe8d12aacab55587f8cf8a7f3e8fa0d64bb76abcfc5b71dbfc7710b871b55145292d6cff89d827e96d413f66d33d7d9b8555d

    • SSDEEP

      12288:zIwKYKwWHGKS8R2jLmgyKlIPoI6sG7I9LKpOjSSbwUw:ZeGtXDyRP6JF7

    Score
    10/10
    xloadercuigdiscoveryloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader family

      xloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks