Extracted

• • Target
    0a9de49281cf90a99f03cb917ac16afe
  • Size 234KB
  • SHA256 66e9a440c0e4719ed9c472be00302f7a1176f48b5e0153284abc0c8060d70306
  • MD5 0a9de49281cf90a99f03cb917ac16afe
  • SHA1 2f38ef814c67f71710b359308be5b980ac54ec46
  • SHA512 c4d9337619f718ec20059cc32470243fc608c20145cf4cbe27282f6c6aab0672d85771e625806a42aaaa7fe440cec87930eca050cc391cd30c86907a6e3a67b5
  • SSDEEP 6144:S9X0G6PHRrBTA8lVcf5fNMRkjqm5kDy8iGLkA:00zfRxAschfSOczToA
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloaderb5i8loaderrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2