xloader

General

Target

JaffaCakes118_74e58b71d9d25130e6b47e1adccd1cf8
Size

493KB
Sample

250107-x3d59svmbv
MD5

74e58b71d9d25130e6b47e1adccd1cf8
SHA1

92fb13e26c1c0ed3698cece64aabe0834b74e798
SHA256

4645255a1302be5b36e6814261279dc48d24f03c3a170b0b2efca04adacd2718
SHA512

991695fd0ea85daf11e7d6da0a9f2079b9da9c46b217ccdccaba6cfdf83ed501188e1efedadab077c5d4bd33bfa430d9456d80ba1b3f92565ab7db5fa0021321
SSDEEP

12288:yo02vVCPnF5+SdVr5PJPawONO/N7coUt:yo02vGPXmwyOmoU

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

yjqn

Decoy

ittybittybunnies.com

flordedesierto.com

cum.care

petshomespace.com

verputzarbeit.com

yuvajanmat.com

getlie.com

finanes.xyz

thelazyrando.com

domelite.design

yukinko-takasu.com

pontosmensal.com

maurlinoconstruction.com

getelectronow.com

newmexicocarwrecklawfirm.com

gunnbucks.com

ncsy30.xyz

opsem.info

authorisewallet.com

scchanghe.com

Targets

- Target
  
  JaffaCakes118_74e58b71d9d25130e6b47e1adccd1cf8
- Size
  
  493KB
- MD5
  
  74e58b71d9d25130e6b47e1adccd1cf8
- SHA1
  
  92fb13e26c1c0ed3698cece64aabe0834b74e798
- SHA256
  
  4645255a1302be5b36e6814261279dc48d24f03c3a170b0b2efca04adacd2718
- SHA512
  
  991695fd0ea85daf11e7d6da0a9f2079b9da9c46b217ccdccaba6cfdf83ed501188e1efedadab077c5d4bd33bfa430d9456d80ba1b3f92565ab7db5fa0021321
- SSDEEP
  
  12288:yo02vVCPnF5+SdVr5PJPawONO/N7coUt:yo02vGPXmwyOmoU
Score

10^/10

xloader yjqn discovery loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader family
  xloader
- Xloader payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader family

Xloader payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2