Extracted

• • Target
    b1e98b432deb419643d81c167fe0dc37_JaffaCakes118
  • Size 253KB
  • SHA256 da0e2504009a426b799d9135979188e2c4533f69c2e981650afc51d5e8e320c2
  • MD5 b1e98b432deb419643d81c167fe0dc37
  • SHA1 305c82fcc0699859e9fe11cc08f8678e23779a3e
  • SHA512 440e0429a4bb817b7ca9bb91f722b6678a6e443a0239a1a859e0de9d8d76f78a4a3c47b2a89b0340f97a9015d852b070788ae1fcc7e0b819115b45c702d661ed
  • SSDEEP 6144:wBlL/c7DTS77ZWSwgwNbXX3VQ+Zw3JlKKjzUh30RfGK54ydrBv:Ce76hw1NXXFx+KzERtdrh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloadermxnuloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/evpz.dll
  • Size 32KB
  • SHA256 439e5f590b4bea13a9bfb7c94bbd8fa99f45a310dc44c241db2375b4e8923cb3
  • MD5 c820bfe346d35f1ed0d3017cadb8f16d
  • SHA1 a98131691df2b4445124304307130888050fe410
  • SHA512 7d89e8677b46c3456559a0061f992be6169c63ec6a2a2eb7ec73ff36fe1fc28cbdbf3436c74fe528572b14f6865ec0f03e5480782243674ffc4423a00cefc66f
  • SSDEEP 384:uIbr7TBKwNuNjiVMauKBO1AhvxF756rLAK5GNrPAg9K8OtwBpYxjETl7:uIZfYNjCy1kxFsr5GNr195OccETp
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloadermxnuloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4