Overview

overview

10

Static

static

3

06211dab16...18.exe

windows7-x64

10

06211dab16...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06211dab16dfd4d59a0ff6990a1e4d91_JaffaCakes118

  • Size

    616KB

  • Sample

    240623-p74mqavejr

  • MD5

    06211dab16dfd4d59a0ff6990a1e4d91

  • SHA1

    843eaee36a7838c082722b71fd0718494366923d

  • SHA256

    d082f4efe5f1c11a527ff389705333792fb7f5499f13a236829b3339c6c99f8d

  • SHA512

    10c9901d73432d6dfed1ebec476906e98881bf131bc5fe7a458dcfa7c728810d30155aa0337ad599f58fd5340249acdc4aee01120a3a49cf62d4deadf1950009

  • SSDEEP

    12288:1MDbQ+X8+UiDLbRHahR9bYJPjPyoYA6p2gkSKGBsSNTVHu:EbQ+X8+UiDLbRHahRGrPzYAM79KnSL

Score
10/10
xloaderu4anloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

u4an

Decoy

charlottesbestroofcompany.com

gxzcgl.com

easyprints.xyz

hitmanautomation.com

play-to-escape.com

beansmagic.com

lianxiwan.xyz

nuhive.net

whystake.com

n6h65.online

emergencyprep4cast.com

peolinks.com

8ls-world.com

tezportal.net

trych.net

bathrobeconnection.com

quinnwebster.top

sagarmakhija.online

ladiesgossiping.com

400doultonct.com

Targets

    • Target

      06211dab16dfd4d59a0ff6990a1e4d91_JaffaCakes118

    • Size

      616KB

    • MD5

      06211dab16dfd4d59a0ff6990a1e4d91

    • SHA1

      843eaee36a7838c082722b71fd0718494366923d

    • SHA256

      d082f4efe5f1c11a527ff389705333792fb7f5499f13a236829b3339c6c99f8d

    • SHA512

      10c9901d73432d6dfed1ebec476906e98881bf131bc5fe7a458dcfa7c728810d30155aa0337ad599f58fd5340249acdc4aee01120a3a49cf62d4deadf1950009

    • SSDEEP

      12288:1MDbQ+X8+UiDLbRHahR9bYJPjPyoYA6p2gkSKGBsSNTVHu:EbQ+X8+UiDLbRHahRGrPzYAM79KnSL

    Score
    10/10
    xloaderu4anloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks