Extracted

• • Target

    b6af62dfb431da0decdd5b947e3d15a8

  • Size

    1.2MB

  • MD5

    b6af62dfb431da0decdd5b947e3d15a8

  • SHA1

    1479f335152bfb7dc22a24638098f17988fa4c8e

  • SHA256

    c070fb4fd74f3cb1b4b739c8b80ea499734a7e9859ff3a0f5cd5a51ac4e0ca7e

  • SHA512

    e383f052ff9de8fb09bdfc88de15ce8f64fe709933aabd4db010b9a3152c3d37359e1414272f9265ae14a8f9128a93d8dbda6ef6b6f49b4be07915da206f7f91

  • SSDEEP

    24576:4VOsBgo0q4wMCBmCmTOUd+L6kyXWMUcm93NchfLD3qg5erpasQZ:40oHMWmCm6Ud+zyXsxqhfHFwRE

  Score

  10^/10

  xloaderwufnloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2