xloader

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_3e3d35afbf473c5ed5aec39aba52346f
Size 827KB
Sample251228-qnsxjsa12c
SHA256 1d2cf0287f43172cf4b7e250574319fa36b733e98878622e2ea016f5c0437679
MD5 3e3d35afbf473c5ed5aec39aba52346f
SHA1 4b47ee201ab67fd115667b0d061a282ed5ffb2f4
SHA512 2c5620c3866a7e8e065e9fb48196236d2e6e7a24e1a23fe241c20d8ae7b3d15be36d8ee5adc5faf1989138a46734cfc9572334dc8a5906f4e9a2b5c668549778
SSDEEP 12288:VSlxw6EsY7vs2L4sjXhM1MFwIJBqHYXRHgMyaGDdlHZB37YdeRazIrIAoS:VSTesYD7ksjS18waBqH4gMJq75h7Yd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

Campaign

de92

Decoy

zindaginews.com
tyelevator.com
schustermaninterests.com
algemixdelchef.com
doubscollectivites.com
e-butchery.com
hellbentmask.com
jumbpprivacy.com
teeniestiedye.com
playfulartwork.com
desertvacahs.com
w5470-hed.net
nepalearningpods.com
smoothandsleek.com
thecannaglow.com
torrentkittyla.com
industrytoyou.com
raquelvargas.net
rlc-nc.net
cryptoprises.com
chinjungmom.com
blondedevil.com
associationindependence.com
tokachiashi50.xyz
cantstoptennis.com
english3s.com
flowtechblasting.com
customputtputtgolf.com
onointeriors.com
lenafive.com
jygraphics.com
plantologia.com
withatwist2016.com
bingent.info
nakedsumac.com
rosetheamazingrealtor.com
gogoivyschool.com
silhouettebodyspa.com
fomssdf4.com
goodcontractor.net
republicpc.com
zante2020.com
t-junko.com
kittens.finance
mkchemicalvina.com
quadacross.com
maemaetravelworld.com
bradforrexchange.com
fashiongomaufacturer.com
hollapac.com
qxmenye.com
neuro-robotics.com
365shared.com
dinamisapp.com
b3service.com
getyourquan.com
udothat.com
cutting21778.com
vdacouture.com
venerossala.com
thefunboxshoppe.com
indomedianewsc.com
nagansatu.com
precisionoxes.com
stonescapes1.com

Targets

- Target
  JaffaCakes118_3e3d35afbf473c5ed5aec39aba52346f
- Size 827KB
- SHA256 1d2cf0287f43172cf4b7e250574319fa36b733e98878622e2ea016f5c0437679
- MD5 3e3d35afbf473c5ed5aec39aba52346f
- SHA1 4b47ee201ab67fd115667b0d061a282ed5ffb2f4
- SHA512 2c5620c3866a7e8e065e9fb48196236d2e6e7a24e1a23fe241c20d8ae7b3d15be36d8ee5adc5faf1989138a46734cfc9572334dc8a5906f4e9a2b5c668549778
- SSDEEP 12288:VSlxw6EsY7vs2L4sjXhM1MFwIJBqHYXRHgMyaGDdlHZB37YdeRazIrIAoS:VSTesYD7ksjS18waBqH4gMJq75h7Yd
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

de92 discovery xloader loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader family
  xloader
- Xloader payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader family

Xloader payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2