Extracted

• • Target

    e1d1316d5bc047ec817b950286734ed0

  • Size

    1.3MB

  • MD5

    e1d1316d5bc047ec817b950286734ed0

  • SHA1

    ae3cb4a0103f8daa9ec8f6dc00b6bfeb3f1c52ca

  • SHA256

    6fd8c63bf53f7364e54505eb98e1b6fc005fbb691a65680e400e7b9104ad1795

  • SHA512

    88a8f1555bc906728a9ab429899e2ae7d5eefa57128072607423cca26e36044160f6383f3568a581a786780a6a0fdd54cf13b9222c550dc6e66b8994fcc2b168

  • SSDEEP

    24576:gzeFrYS/d3kYdkhlOAnxHRrjz+LVL+eQBDmwRGPoN7vdiTbnFM:5H2lOAnxHRrjz+ZL+eum/PoiM

  Score

  10^/10

  xloaderajs8loaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2