Extracted

• • Target
    rove.exe
  • Size 225KB
  • SHA256 3e23bf4937349c5f5cf233e30658562fca94d58790ebbe693e176fb595fb0b34
  • MD5 21c95cd527b83b95ccdb7f57c966a0e3
  • SHA1 fe4a4956e18ab19011b5da324df71128560d0f8c
  • SHA512 dcf4d7663cc93d97ecaa7b5d619ca62cda6af183bb477cf95fd42d5c166c96ed2925a3519a393bf4b04c73967bd6b82456d3b7ff0d794b76831dfe1ecc008525
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2