xloader

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_3409ba6e1c039ad2218f5725348625e5
Size 1.1MB
Sample251123-2a4yfaymfm
SHA256 269dee4e25d9e9c85856a34cc30115c2eaf5db56972f89cc675127f5290afe64
MD5 3409ba6e1c039ad2218f5725348625e5
SHA1 3b12f5c0c80d19e2dbbabc6db16a254192ecf785
SHA512 da18c1317075b04c080cb79c1f17358cae118091b5061029a33f0d6559fd19b5dcac4c7552c7b5954e81d22476e656e2c101c44efd54505edc0d20fdd2ef7479
SSDEEP 12288:WKE77u/zCGY+deHLyhBa6yFB1b2WSrepyMEKjg8P7+r/H+q366t9SMPQipW5E:N7nMLwg6JhreEMXjt7+747ipB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

Campaign

66op

Decoy

ttxyzp.com
miamivendingservices.com
namanhphat.com
filmexllc.com
snowflakebytes.net
qygdance.com
small-mart.online
libryapp.com
guadelouperegistry.net
hoodiessport.com
tienda-china.com
musicergonomy.com
yahonatinog.space
lvn.xyz
aerospace-engineers.com
bluemountainbeveragecompany.com
thedonationcard.com
gigharborcancercare.com
restondefencejobs.com
alfenafootwear.com
351215.com
cloudlmis.com
nowprepared.net
fossa.network
westlandphotographer.com
chihvacassociation.net
magictrick-s.com
police-baton.com
notaria12.net
mortonwine.com
cottonordinary.guru
halloweenfunshoppe.com
saadinuts.com
naomieducates.com
universalmailinvoting.com
volkras.com
laganacheconfections.com
fullmoonrestlessco.com
dnhsxm.com
silkway777.com
e-lohas.info
misstenazas.com
aplikasihotel.com
desirexpress.com
returpen.net
contrastblogger.com
wttfiber.com
finoblog.com
engraved-plate.com
mimik33.info
dolphinresinsandpaints.com
4getmoreplandata.com
unemmploymentpua.com
onixtours.com
healebear.com
mauritiushackathon.com
kyowaunyu-recruit.com
northstarinterface.com
startersattorney.info
tailgatorstruckshop.com
neutralogics.com
xn--se-zia.com
gcuea.com
opencollective.digital
kkkwhitepride.com

Targets

- Target
  JaffaCakes118_3409ba6e1c039ad2218f5725348625e5
- Size 1.1MB
- SHA256 269dee4e25d9e9c85856a34cc30115c2eaf5db56972f89cc675127f5290afe64
- MD5 3409ba6e1c039ad2218f5725348625e5
- SHA1 3b12f5c0c80d19e2dbbabc6db16a254192ecf785
- SHA512 da18c1317075b04c080cb79c1f17358cae118091b5061029a33f0d6559fd19b5dcac4c7552c7b5954e81d22476e656e2c101c44efd54505edc0d20fdd2ef7479
- SSDEEP 12288:WKE77u/zCGY+deHLyhBa6yFB1b2WSrepyMEKjg8P7+r/H+q366t9SMPQipW5E:N7nMLwg6JhreEMXjt7+747ipB
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

66op discovery xloader loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader family
  xloader
- Xloader payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader family

Xloader payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2