Extracted

• • Target
    3737a705b553c9a6245722aa948a2beb_JaffaCakes118
  • Size 423KB
  • SHA256 612a346d3e2412113c53343b67419bc7a13bcf1bfe890137b68b3b5553a20096
  • MD5 3737a705b553c9a6245722aa948a2beb
  • SHA1 b6a2abfaaffbb3560dc9ebae6f3bd14aa0594b44
  • SHA512 401c211911ab46dfe85c015e2aa9c469f5486457f980c5eea4bf5e27ca74d13069c74ff9844cfd2d755e6ca44997e1ad49655bd8d383366ab40ed48e709ef22a
  • SSDEEP 6144:VBlL/ideqEZ6AVoZcSJGr9TB0PvQqlKxOwCOnPj+p9sHRBNmoJke6:DRvrVpovkEQnPip6HdMP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloaderb2c0loaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/wxmkcb.dll
  • Size 30KB
  • SHA256 b31b5199366598aa7e035d334e1f045b79902aedb13186f8ba178f9cc8d7b49a
  • MD5 0c830a1bd50b239167ea8a7bdd68e095
  • SHA1 e65f3280c817f0f7e52a52112121d17ffcbc7e5d
  • SHA512 c81ced34a906cfcd2e79466a0cbed7bcca3d5d830dcb5b710d45ea2d572d19763bd7721c55368e80a015e716f47e0fe8f45acf30d8e8e24e9d4c0e3d00dffa17
  • SSDEEP 768:SSFszi/seKQIcgu2VUMyPx470ahDw+GTN:mzl9QIcgu2v2ah9G
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloaderb2c0loaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4