Extracted

• • Target

    Ygqayrvpsvjdxblkzsmxymjfnxukvrdvft_Signed_.exe

  • Size

    1.1MB

  • MD5

    75835dd5ce974af3a4d73e8ed4ca8632

  • SHA1

    f22073cb3a889efbe7412802885f64778c6a0139

  • SHA256

    48d7ee8524b6c594ee30967ffa0b0c651ff0ea54162aa142e13fcd9c9a577125

  • SHA512

    05c93e7ad76f9a06fd12debf4c9068e712edfbd6d75894608f8237e93e32f33be794d88c2de9625f5d3a43b66cf525b45a3cffa315fed57c6a7df894933e4b81

  Score

  10^/10

  xloaderloaderpersistencerat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2