Extracted

• • Target
    Unpaid invoice.exe
  • Size 450KB
  • SHA256 1bbc8a34b7590c1593c5a79a8d0f93b17a162f44893c37aa11e4cb9e0e2d96bf
  • MD5 98d2d5ac3bd493d77f0a7300a43d045b
  • SHA1 7fdd3b9b76f2c40df10def7ec3aa25c4fb192ec7
  • SHA512 32b7aa0518d6b41864d0f6f90d397cd377244b8f6af07178252aeb5b7ecf57e347c2aa2a3a4d94327d799bfcf8fe87b5c8164b0102c64258fd55a4c024ad0ef3
  • SSDEEP 12288:g4fXqKkoo4mdIaFOyzsfUvCqqTb+3e3DcGv2:9PbkoodWaEXU6P/2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloaderb2c0loaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/gyalquzbu.dll
  • Size 33KB
  • SHA256 db7b70b0734285b8d9a1f3617e55603b0cb649d9bf0b7fbf8988c44e684f4e76
  • MD5 a8caa6d267951ad22e835233b5e50c46
  • SHA1 45c722c5958d99727a95d30eaa3032203d1f4ab2
  • SHA512 9ee74bf576554210f8923dda8aa28f6dc7f3c5aa52da7b48a94beaf56cb4e27f1c3d0387cc9116e467631bc13c0e743341129bffa84b9db16ace1248a53b4cd7
  • SSDEEP 384:8o2En0QXbRRe9fsWZAmSlmMNAC8Qqgqdq9RHvHZXktPaa+LiJtLydc8f1eWU9Rkj:L2zf9HPaa+2tLKJcMaTxOMFs0o
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral3behavioral4