xloader

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_3eec66e80f478d2730d7e128d393460d
Size 887KB
Sample260102-xyvmfsal2x
SHA256 6acec5800bb6a457e47029754e9eb7d6bf405ff56ea9f074741dabfdac141c18
MD5 3eec66e80f478d2730d7e128d393460d
SHA1 b86c0705c6b9cf3101f7d5fa17d094ec7cb3d3da
SHA512 5a9425722539d2053b39962ee2b6f3df61c896946664638b180723979a6b024f8c3d5c7d48dcba5eb00bc93f1498744919f9d1790662e851c9bfd3f45905cdfa
SSDEEP 12288:01reKHYr7AoOCo42Y1e0Lwrqo2MEzV1z/sgx6CD8eXqcfAq788iTw:ai7PgYUGwGo2zznNx6C5Xqcfbi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

Campaign

ehxh

Decoy

financialaccompany.com
face2bouk.com
blazedisinfecting.com
providaconsultinggroup.com
distriautosdelpacifico.com
myaduhelm.com
thangmaygiatot.com
nuevasantatecla.com
endpedophiles.com
alwanps.com
anzi-studio.com
twoswinginghammers.com
curbedinc.com
purecleantn.com
4levelsplit.com
talklinecall.com
egypte-vakanties.com
xzntfwof.icu
sosyoclassic.com
adjoalearningacademy.com
alphacinema.net
lady2lover.com
eleanorandhick.com
kimsfist.com
pemasangangipsum.com
mrkabaadiwala.com
alltechengwork.com
marvitrans.net
islamicwatchdogmovement.net
fortunefoundrydesign.com
911strongerlife.com
cb13xxx.com
ameriloans.info
grantmohnphotography.com
iregentos.info
tubeknows.com
clarkacademiccoaching.com
hongzhifreight.com
sparkletosprinkles.com
sprtncloud.com
goegoldenretrievers.com
highstreetwear.com
channel22newz.com
jmuboprivacy.com
ayurvedayogasardinia.com
resethire.com
simplyrita.com
fatlosszone4u.com
brian.productions
qoogaloo.com
aubreyntaylor.com
jorgianamarlowe.com
onemilliondollarsapp.com
kontenery-pawilony.site
navinkhumui.xyz
lacroixandkress.com
luxlectric.net
haypr.com
lusomarkets.com
laplumebodas.com
leadhorn.com
masksthatsmile.com
suoxqxnnoj.net
xiamen8.xyz
lensinlens.com

Targets

- Target
  JaffaCakes118_3eec66e80f478d2730d7e128d393460d
- Size 887KB
- SHA256 6acec5800bb6a457e47029754e9eb7d6bf405ff56ea9f074741dabfdac141c18
- MD5 3eec66e80f478d2730d7e128d393460d
- SHA1 b86c0705c6b9cf3101f7d5fa17d094ec7cb3d3da
- SHA512 5a9425722539d2053b39962ee2b6f3df61c896946664638b180723979a6b024f8c3d5c7d48dcba5eb00bc93f1498744919f9d1790662e851c9bfd3f45905cdfa
- SSDEEP 12288:01reKHYr7AoOCo42Y1e0Lwrqo2MEzV1z/sgx6CD8eXqcfAq788iTw:ai7PgYUGwGo2zznNx6C5Xqcfbi
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

ehxh discovery xloader loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader family
  xloader
- Xloader payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader family

Xloader payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2