xloader

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_3ed71f97489274760b6cf02192304259
Size 736KB
Sample260102-tm5fqscy5c
SHA256 fd3450b3f8973200c17fb786110c7a8f7c6994833137ca37322355d1ab9c8e82
MD5 3ed71f97489274760b6cf02192304259
SHA1 ed19e5dc43352445b1ee3c9d0880661d4a0d3dc4
SHA512 5e617401a943a5b1b475ddfa0f005ad451918d5ac276002ac150bf5e3bf9b2e90b6d731468e96959674b94d1d17988aadac604b732ef8ae11f03e5f7e10760b3
SSDEEP 12288:WBTK1no2igDy+kRa4HkFrSzjCxc7Ze5w8zyQesOw:jVodEy+qTEF88MGwkN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

Campaign

oean

Decoy

keboate.club
whitehatiq.com
loimtech.com
icaroagencia.com
snigglez.com
noreservationsxpress.com
villacascabel.com
5037adairway.com
growingequity.fund
stafffully.com
bingent.info
tmssaleguarantee.com
neonatalfeedrates.com
george-beauty.com
oraghallaighjourney.net
zunutrition.com
sylkysmooveentertainment.com
ddmns6tzey2d.com
dvcstay.com
304shaughnessygreen.info
ourbestbutes.com
taob345.com
fadhilaaqiqah.com
freshmarketfood.com
digitalcreativeclass.com
bitcoin-devnotes.com
rentapalla.com
ethiopianjulary.com
skillsknit.com
circleoflifeco-op.com
esteemquantum.life
indiashiksha.com
yqhbcapzy.icu
goldcrownusa.com
cinefil-i.com
pickmeagift.com
biomig.net
actusdumoment.com
theglobalfeedback.com
skindetailing.com
simplifiedvirtualsolutions.com
ggss081746bcd.xyz
spreadaccounts.com
kapiscart.com
fuyigranuletion.com
doxinlabs.com
piemontelaw.net
kstamerica.com
tueddur.com
opmania36.com
cartooninhindi4all.com
chefericcatering.com
tenshounoyu.com
over64.com
kerifletcherrock.com
ruidongcctv.com
ceejing.com
dailyxe.online
ubiquitus1.com
binggraesantorini.com
eggsmission.com
revolutionarydisciples.com
eatrestmoverepeat.co.uk
kyleknievil.com
classifoods.com

Targets

- Target
  JaffaCakes118_3ed71f97489274760b6cf02192304259
- Size 736KB
- SHA256 fd3450b3f8973200c17fb786110c7a8f7c6994833137ca37322355d1ab9c8e82
- MD5 3ed71f97489274760b6cf02192304259
- SHA1 ed19e5dc43352445b1ee3c9d0880661d4a0d3dc4
- SHA512 5e617401a943a5b1b475ddfa0f005ad451918d5ac276002ac150bf5e3bf9b2e90b6d731468e96959674b94d1d17988aadac604b732ef8ae11f03e5f7e10760b3
- SSDEEP 12288:WBTK1no2igDy+kRa4HkFrSzjCxc7Ze5w8zyQesOw:jVodEy+qTEF88MGwkN
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

oean discovery xloader loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader family
  xloader
- Xloader payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader family

Xloader payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2