Extracted

• • Target
    c2474e0bb1bd34461d6bb9400a0a67c1
  • Size 351KB
  • SHA256 b56e7b2be2bb194db6e8e7c95e9477c49863e0eb8d2818f266f69e8e1a09647b
  • MD5 c2474e0bb1bd34461d6bb9400a0a67c1
  • SHA1 b57bbc6d45bb145204de0b68b2d59253734fbef7
  • SHA512 6c9c8976b57c3af3c2a6697edbb9bb3772cc0702f20bb42b874c589968c2fdb5ef9fbf8650da2443847aec1aa50c97743ba906263f2af1cfe2684694196c5aae
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderdy8gloaderpersistenceratspywarestealer

  • Modifies system executable filetype association

    persistence

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2