Extracted

• • Target

    a1a8b78f7d0967e3690c42442a7225a5

  • Size

    1.2MB

  • MD5

    a1a8b78f7d0967e3690c42442a7225a5

  • SHA1

    b0cfacdc0d59c62ef064d3d113330ea475c16a43

  • SHA256

    39c6360f8c3d77d905cfea361ab4858a8b216b173b975c81677ff0e341e9432f

  • SHA512

    30deab758bfd222afa8df5b1f957c698d6802caa4b46434484be7677814ce8d5c9c110454efd2b22fc010404673446636e66bce493cf501fcb24822a5788546a

  • SSDEEP

    24576:RYr1CmATOsBgo0q4wMbJ0E33nWghuYfp:R7CoHMbJDHGK

  Score

  10^/10

  xloaderu3r5loaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2