Extracted

• • Target
    c0eb90010d882e33340c40bde08474cb_JaffaCakes118
  • Size 257KB
  • SHA256 014fdffc1561ee767b1189c5b496f587d16ba7d394ca9d26d2e7d6f8541ebc92
  • MD5 c0eb90010d882e33340c40bde08474cb
  • SHA1 f76f7e4eff72ed9d5669cef62ecda5b65d051c84
  • SHA512 19cc012358ad74980a8f1e18bcad3718a5fb36559d5bbfe220c534c271cd8f2701cce06416438796b9dbcb97769d4b3467e0e23a13c49bc60e597e0a6ad49e13
  • SSDEEP 6144:F8LxBsM33J1rFUe7alz20oWieTVzbNFhNFYwENyshjvsGEOdxn:/M3frFL7MFviQVxFhQJhLs3Oj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloadermxnuloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/fgxbpquymg.dll
  • Size 27KB
  • SHA256 1618a682392591c00a2ee82b7eb7f4f082ec34350ad30dbe619b57198688b1e8
  • MD5 0b97cba1e0824c22255acd7317ed649d
  • SHA1 5c015f2a900554ba0d2303f5da3ebbaa78f7940a
  • SHA512 e14ff3d23a702ff88077155e4c3262abcb20ad4d63d95070ad27046284db1ecaa586cef4a8ab22d1dd7d0361966d24f418d039cc04a52309ab9314f7fa58f123
  • SSDEEP 768:1oFujLc9Rml6Y8fFbSNAkYaX7mpBfZC3/NcSPcM2:6kLUmlFKzasBBC3/NcnR
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloadermxnuloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4