xloader

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_387bb5107b2f5287c9284b92a8201caf
Size 1.2MB
Sample251218-zh7ceset6a
SHA256 48e5295db9ba78034bfd5ff510f893c40a6cddee73f99421aa5b77d566ed715a
MD5 387bb5107b2f5287c9284b92a8201caf
SHA1 79a73014d31b783e252f8b8f848b64e3cc66cab0
SHA512 7fe182df4cb870bddb6cd789936fe7f395e3c090c5286c90a5679ae641fb742e3ef1dc6375ead04e935da4c6433b486c52b8fb49aac6e94dc0b80c7867f46ebf
SSDEEP 12288:DoJmyo4lHmVbCgfSZO0sL1PCoNzHONAc0Lx4/F3usxvYUV0W5VXIzZko6nCsSqr2:c04lHU2g2C1KoVQRMCF3usxr0W5VXS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

Campaign

gqx2

Decoy

calusaptamiami.com
starlinkwebservices.com
lakeviewbarbershonola.com
oaklandraidersjerseyspop.com
ohiotechreport.com
eligetucafetera.com
tu4343.com
abstract-elearning.com
thebabylashes.com
athleteshive.com
fanninhomesforless.com
sembracna.com
servicesyn.com
bellairechoice.com
tmpaas.com
eyepaa.com
stickerzblvd.com
rentfs.com
nadya-shanab.com
microwgreens.net
overnaut.net
edwinstowingservices.com
bonus189.space
xn--wgbp0b73b.com
trijjadigital.com
libraspeed.com
theofficialtoluwani.com
podborauto.pro
qyhualin.com
prayerswithmary.com
donboscohistorycorner.com
enlightenedsoil.com
osteopathegagny.com
lookingglassland.com
maglex.info
foxandgraceboutique.com
yourinfluencecoach.com
com-cancel-payment-id655.com
ppspiaggio.com
dbsadv.com
teamworkdash.com
washington-election-2020.info
creativehighagency.com
artisthenewmeditation.com
qsgasia.com
unseen-vision.com
beepybox.online
shaffglowing.com
teacher-retirement-info.info
muabandatdonganh.com
shuhan.design
5200853.com
shengmixiaoji.net
spiderofthesea.com
scionoflewisville.com
tpcvirtual.com
zhjiaxiang.com
thefanexam.com
kimscraftyresale.com
housvest.com
bukmyhotel.com
lacaverne.ovh
investorspredict.com
quicklogosireland.com
inreachpt.com

Targets

- Target
  JaffaCakes118_387bb5107b2f5287c9284b92a8201caf
- Size 1.2MB
- SHA256 48e5295db9ba78034bfd5ff510f893c40a6cddee73f99421aa5b77d566ed715a
- MD5 387bb5107b2f5287c9284b92a8201caf
- SHA1 79a73014d31b783e252f8b8f848b64e3cc66cab0
- SHA512 7fe182df4cb870bddb6cd789936fe7f395e3c090c5286c90a5679ae641fb742e3ef1dc6375ead04e935da4c6433b486c52b8fb49aac6e94dc0b80c7867f46ebf
- SSDEEP 12288:DoJmyo4lHmVbCgfSZO0sL1PCoNzHONAc0Lx4/F3usxvYUV0W5VXIzZko6nCsSqr2:c04lHU2g2C1KoVQRMCF3usxr0W5VXS
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

gqx2 discovery xloader loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader family
  xloader
- Xloader payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader family

Xloader payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2