Overview

overview

10

Static

static

3

74bd3fc078...18.exe

windows7-x64

10

74bd3fc078...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118

  • Size

    408KB

  • Sample

    240531-dq6vzaec82

  • MD5

    74bd3fc0782c84d45e5659a378f9dc01

  • SHA1

    e905675d92d1ee0d278796af59827b1231cc9d34

  • SHA256

    bffc9c0c74952c439ca980be37a1f1e21c182b13c992f1a345a541413bfea91a

  • SHA512

    0da4491c4558970de3f13a85769d73354b2b369031fd3bfee2c8d3a393c814a005f6f2a3e32edf4d5c563dfaf0b3fdb1c49006ec51c2bd673bb814517dba7e80

  • SSDEEP

    6144:LHAgbCa8sGQTpS1KzolRLNYXkw7W1ZA4s9m8HTVZ:LHX8kT8KznXkBskUTVZ

Score
10/10
xloaderu4xnloaderpersistencerat

Malware Config

Extracted

Family

xloader

Version

2.1

Campaign

u4xn

Decoy

yanghl.com

decorvea.online

xn--fjq92bw28b1tloj5a39d42h.com

yumler.info

laketravisautosales.net

zjnrgx.info

harrimanpm.com

dell-yh.com

eze.fitness

pritpritzoom.com

hackgarage.com

mydomterry.net

castrotom.com

coffeecosplay.com

wsfg-hk.com

crystalbeachstudio.com

bestofreadbook.win

sutasz.info

yunfengyue.com

h11011.com

Targets

    • Target

      74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118

    • Size

      408KB

    • MD5

      74bd3fc0782c84d45e5659a378f9dc01

    • SHA1

      e905675d92d1ee0d278796af59827b1231cc9d34

    • SHA256

      bffc9c0c74952c439ca980be37a1f1e21c182b13c992f1a345a541413bfea91a

    • SHA512

      0da4491c4558970de3f13a85769d73354b2b369031fd3bfee2c8d3a393c814a005f6f2a3e32edf4d5c563dfaf0b3fdb1c49006ec51c2bd673bb814517dba7e80

    • SSDEEP

      6144:LHAgbCa8sGQTpS1KzolRLNYXkw7W1ZA4s9m8HTVZ:LHX8kT8KznXkBskUTVZ

    Score
    10/10
    xloaderu4xnloaderpersistencerat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks