Extracted

• • Target

    e97a56b53d4cda1a7bbe5b950fac1648_JaffaCakes118

  • Size

    936KB

  • MD5

    e97a56b53d4cda1a7bbe5b950fac1648

  • SHA1

    7449b26c27643685e568cde811d82b2105270073

  • SHA256

    8fbd9e0de6ff63af1fdef9c836ca62f662c1bfd091dc2fe046cfa266d4b27bd0

  • SHA512

    4b9a4c02aa2b3233add599452804dd11358700750a7b834748796588907b68a7493ccacb7a8a239708f939659cdc4c3dcf29caa67868f6a6be9dcbaac04ec048

  • SSDEEP

    12288:OVg0y1/ug8NSc07iS/d348yoBoRoDoyoo38Z9dVhDs6zvwIXvP6mjH9DXF9tGQMI:Byg8jS/d3YK64JS66zvTXvrxV3Iq

  Score

  10^/10

  xloaderp2ioloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2