xloader

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_3a9e68325d16c69df66db1b81f666601
Size 1010KB
Sample251218-2mm6fsxmex
SHA256 82809ddcfce7489cd7b3c92abf7a4f8d4cc3a0b7b98f03712b7828c24d823b80
MD5 3a9e68325d16c69df66db1b81f666601
SHA1 21a067ed90eb91cb58466b00d379812823aab451
SHA512 c724a00a837b25ba95eeeb6980340fc4374f3c2f82dce00f0e18599a2e51cf2d72deb80310e79f070888699762c2a1e972fae53fafed8b818262f75e438f4dba
SSDEEP 24576:MNyO06jyOSjthA/GguvSz43Y8/ad1MBcBVhDOS9ntAw32AQxx:ch+thAGvsaNO0cBVROMAw3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

Campaign

oean

Decoy

keboate.club
whitehatiq.com
loimtech.com
icaroagencia.com
snigglez.com
noreservationsxpress.com
villacascabel.com
5037adairway.com
growingequity.fund
stafffully.com
bingent.info
tmssaleguarantee.com
neonatalfeedrates.com
george-beauty.com
oraghallaighjourney.net
zunutrition.com
sylkysmooveentertainment.com
ddmns6tzey2d.com
dvcstay.com
304shaughnessygreen.info
ourbestbutes.com
taob345.com
fadhilaaqiqah.com
freshmarketfood.com
digitalcreativeclass.com
bitcoin-devnotes.com
rentapalla.com
ethiopianjulary.com
skillsknit.com
circleoflifeco-op.com
esteemquantum.life
indiashiksha.com
yqhbcapzy.icu
goldcrownusa.com
cinefil-i.com
pickmeagift.com
biomig.net
actusdumoment.com
theglobalfeedback.com
skindetailing.com
simplifiedvirtualsolutions.com
ggss081746bcd.xyz
spreadaccounts.com
kapiscart.com
fuyigranuletion.com
doxinlabs.com
piemontelaw.net
kstamerica.com
tueddur.com
opmania36.com
cartooninhindi4all.com
chefericcatering.com
tenshounoyu.com
over64.com
kerifletcherrock.com
ruidongcctv.com
ceejing.com
dailyxe.online
ubiquitus1.com
binggraesantorini.com
eggsmission.com
revolutionarydisciples.com
eatrestmoverepeat.co.uk
kyleknievil.com
classifoods.com

Targets

- Target
  JaffaCakes118_3a9e68325d16c69df66db1b81f666601
- Size 1010KB
- SHA256 82809ddcfce7489cd7b3c92abf7a4f8d4cc3a0b7b98f03712b7828c24d823b80
- MD5 3a9e68325d16c69df66db1b81f666601
- SHA1 21a067ed90eb91cb58466b00d379812823aab451
- SHA512 c724a00a837b25ba95eeeb6980340fc4374f3c2f82dce00f0e18599a2e51cf2d72deb80310e79f070888699762c2a1e972fae53fafed8b818262f75e438f4dba
- SSDEEP 24576:MNyO06jyOSjthA/GguvSz43Y8/ad1MBcBVhDOS9ntAw32AQxx:ch+thAGvsaNO0cBVROMAw3
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

oean discovery xloader loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader family
  xloader
- Xloader payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader family

Xloader payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2