xloader

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_2fa809111f6953a10bcae39ef3f57aa7
Size 818KB
Sample250928-14m2cahn2y
SHA256 7b4c1bf9a15a419080fe02866aa26f162f79d5e01763c6af5915b07988556223
MD5 2fa809111f6953a10bcae39ef3f57aa7
SHA1 9415a9c252e39776162749c9131d96274cd6cac9
SHA512 adb6b340237a62af5fced4c819bfa92317e15a4062dab379d97a1b2ecd9e5ace9fca9330872f7d4f01c2a0b96035d9a69a376d7f7c812fece8584326447933b9
SSDEEP 12288:DBGiY6HkFug86gomJluiCSGV/OeZksg3ifNiYBKkZTIHmtiK5owFGx:DA6EFuWMluiCSk2etf4YXhIH+Fowe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

Campaign

gjeh

Decoy

carmator.com
bsbqrp.com
siemens-mp.com
dunnfloorcoverings.com
cpassminimedicalschools.info
howtodesignyourhomeoffice.com
famliytaste.com
freesocialmarketing.com
jejuhaenyeo.net
tradebot.icu
arzug.com
carrefour-solucoes.online
ladyom.com
aoironote.com
newmexicocarwreckattorney.com
wealthpatternsllc.net
thinkpinkalicous.com
prajapati.company
bjhwky.com
jsdigitalekuns.com
hada-kirara.xyz
cryptochatr.com
ehao5ahhl6.com
i8news-sv.website
12sky2limitless.online
royalknightent.store
dualvisionproductions.com
nextgenerationracingleague.com
1dy17.xyz
vineethnekuri.com
offlces.com
mmpluk.com
4kwallpapers.online
yakyu-eiga.com
advertisingresult.com
ktshandymanservices.com
reyizz.com
ethics.tools
cyberbesttechnology.com
glopik.com
claybycollins.com
buythedamnbike.com
7q3qq3.com
normanwagers.com
editoramandacaia.com
fscmyc.com
contactosasi.com
brightpretty.com
glavins.net
demoxyz.online
apnagas.com
drdavesea.com
wholeheartedfounder.com
gunpowderz.com
thegliderguy.com
drawcen.com
7777wns.com
tecmovco.com
a3chic.com
alattarherbs.com
tracks-clicks.com
appioservice.com
matthewwesco.club
lampshadefish.com
getaudionow.com

Targets

- Target
  JaffaCakes118_2fa809111f6953a10bcae39ef3f57aa7
- Size 818KB
- SHA256 7b4c1bf9a15a419080fe02866aa26f162f79d5e01763c6af5915b07988556223
- MD5 2fa809111f6953a10bcae39ef3f57aa7
- SHA1 9415a9c252e39776162749c9131d96274cd6cac9
- SHA512 adb6b340237a62af5fced4c819bfa92317e15a4062dab379d97a1b2ecd9e5ace9fca9330872f7d4f01c2a0b96035d9a69a376d7f7c812fece8584326447933b9
- SSDEEP 12288:DBGiY6HkFug86gomJluiCSGV/OeZksg3ifNiYBKkZTIHmtiK5owFGx:DA6EFuWMluiCSk2etf4YXhIH+Fowe
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

gjeh discovery xloader loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader family
  xloader
- Xloader payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader family

Xloader payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2