Extracted

• • Target
    0da6c44a23c1ee34c1d79ae4abd8547c
  • Size 325KB
  • SHA256 71bad0685e5b2447a8dcdc960ee2930ad5ec4910d5d449040fb52cb9754df2a2
  • MD5 0da6c44a23c1ee34c1d79ae4abd8547c
  • SHA1 b8e668d2d9cad532227f0c4ec8b25ca5d770684e
  • SHA512 d3d6003b28ec8a2cc935e461cae5e396045cf3d060f676017fa3129b4642c7be26c68bc71e2776e77b8bc265cf094031dfca383698829e3a484424582bf6d19b
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderp2a5loaderratpersistence

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Sets service image path in registry

    persistence

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2