Extracted

• • Target

    495a3851285b29a43693cf5a93516608

  • Size

    1.2MB

  • MD5

    495a3851285b29a43693cf5a93516608

  • SHA1

    7ef194179534a1d0a1a7aa4aacd504c0f6e05853

  • SHA256

    d4dbb398a31310583837a0e3152c739f965ecf44c01e0aacd0249a85630d88be

  • SHA512

    2e7f7849d731f69007f5b80a71b6981c88b110a086ef655b556f59b9f2cc892c453c9b921dc7d9c6646c191737f222c88d5060e0d9d160f57ef1c9f5bbdbd9c3

  • SSDEEP

    24576:xDS/d3BKzksPks2y8jeLELZ7UuyvA1MN7ZNZZ:AKquLEF7UzvbN7ZNZ

  Score

  10^/10

  xloaderwufnloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2