Extracted

• • Target
    vbc.exe
  • Size 683KB
  • SHA256 39ce700e582c22bf87f67241aa5537b74991a30d016878bdd6c2dfd6dc114f9d
  • MD5 04ae989498b84c026d4f3d4e45d00cdd
  • SHA1 45c6792e4c34c5adc08967077bb29c76ca44e601
  • SHA512 1598a8c43e1f8e1c1e6ec67999bae0faa295be961099979ed0885e41f42168d2fdd3dce83ea3d9c9e7703299d6ef7b832579065122fb946ed193a37d84c77cad
  • MD5 SHA1 SHA512

  Score

  10^/10

  persistencexloadere3rsloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2