Extracted

• • Target
    0a0b65f309a35b8c4f2976a97363c398_JaffaCakes118
  • Size 249KB
  • SHA256 7d193ee636a32820be667d76f35258c087604539f5a52a442ba947339eb8ae58
  • MD5 0a0b65f309a35b8c4f2976a97363c398
  • SHA1 14d9e3a08571169103420909073ac186ae034eee
  • SHA512 c66de247b8ced1a86eecff73823767b6349a8983267a00bb3f7e5ad7644cbb3fededf442590a32c8dd571c2d83575aa9d49fd69677ce050d5d2bb20f8edbc10b
  • SSDEEP 6144:wBlL/crvqxLvnth1Pi9I0qI9wCG7QSTVOqfiDI6CH4/PGNZa0QYo:CervcvnHFJ0L9wCG7QSraDIFH4/PmA
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloadermxnuloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/dpzqzg.dll
  • Size 31KB
  • SHA256 8a6442971a1c7f3ed896d6feebcdc009d71570a6a144ad70178c6123cc1d90ce
  • MD5 9bdddd9535bf57393703d05ec9dd555d
  • SHA1 d2ddba9150c10d60216ccd6fe87082d0babb9c84
  • SHA512 8643eb9d9bfc23f349fc7e8aa27f6b3e9783a52d819df9a76edfae3abb021c3a348eea0b6a77d4267df363fd2a758049eef4e9e10dba155c3e0eeaf38d915e86
  • SSDEEP 384:y8fNgOuCHP+Ang3eF+6Kswci/+9YFju5kKQHZ8Fz7cs2NugH7bVF4JtQ3sDLnDT2:1kpszi/1u2KQKZ7cs24gdF2tjPDTt
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloadermxnuloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4