xloader

General

Target

JaffaCakes118_d40d16f11bd6a0f337f9e5ea381cc9da
Size

585KB
Sample

250109-2jbcgsvqhn
MD5

d40d16f11bd6a0f337f9e5ea381cc9da
SHA1

abcce81167138b25b794617bc0998db3337ecd6e
SHA256

abf5690018f60f621f9bd9e5e342d310825e3b3ad2d8ddfb0c5b1b0de95ee846
SHA512

c727da32eeca51397249b798c5faf3537af508f945a125624b082edbbed07ca26b405943c91728d0a738e51d89c3324c2b152be660b7da63c2a746bfa2799157
SSDEEP

12288:y4n3bUzN/aLflq8FJwY1z6eRuQtbbtLlOhsxeHHk:N6CRSY1X99ppOyxenk

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

fqiq

Decoy

driventow.com

ipatchwork.today

bolder.equipment

seal-brother.com

mountlaketerraceapartments.com

weeden.xyz

sanlifalan.com

athafood.com

isshinn1.com

creationslazzaroni.com

eclecticrenaissancewoman.com

satellitephonstore.com

cotchildcare.com

yamacorp.digital

ff4cuno43.xyz

quicksticks.community

govindfinance.com

farmersfirstseed.com

megacinema.club

tablescaperendezvous4two.com

Targets

- Target
  
  JaffaCakes118_d40d16f11bd6a0f337f9e5ea381cc9da
- Size
  
  585KB
- MD5
  
  d40d16f11bd6a0f337f9e5ea381cc9da
- SHA1
  
  abcce81167138b25b794617bc0998db3337ecd6e
- SHA256
  
  abf5690018f60f621f9bd9e5e342d310825e3b3ad2d8ddfb0c5b1b0de95ee846
- SHA512
  
  c727da32eeca51397249b798c5faf3537af508f945a125624b082edbbed07ca26b405943c91728d0a738e51d89c3324c2b152be660b7da63c2a746bfa2799157
- SSDEEP
  
  12288:y4n3bUzN/aLflq8FJwY1z6eRuQtbbtLlOhsxeHHk:N6CRSY1X99ppOyxenk
Score

10^/10

xloader fqiq discovery loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader family
  xloader
- Xloader payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader family

Xloader payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2