Extracted

• • Target
    Citvonvhciktufwvyzyhistnewdjgsoqdr.exe
  • Size 704KB
  • SHA256 aace20e28e61cb328da74ff938231b1ce9a07498d477efe3efc5c5d3d04b9dc1
  • MD5 4e71f90d1817f44313f4e101ef393968
  • SHA1 3932f9822134761e7bf9bc1902f8cc28b6820559
  • SHA512 a50c0e27009521b2f34358fb3bc30afb661b75cb6ba715ac8be15f412b50600dc3a474bd90de74c1e1b3941f3bc0d80c7b7e16aa26969a4250ec7f4dcd234419
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderloaderpersistencerat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2