Extracted

• • Target

    f2654cd7598c850ba9229ce85998b556_JaffaCakes118

  • Size

    1.1MB

  • MD5

    f2654cd7598c850ba9229ce85998b556

  • SHA1

    6108ca584686f895fe949878af699e846cbe19d0

  • SHA256

    a580a0ff9f6c6a6120632d565e69978de243842368c34c3f2abb3de3f441e06b

  • SHA512

    d911bab4267a5ff0907f09e5fe4a3c22e18452659e0af17bc9dc719ba5fb27e2863429cf28debe11597209c15cb22a4c7226310f5dd2ff2984030e91fa7051c0

  • SSDEEP

    24576:odS/d31Kzks8ks21oODt9HJcPNoPZBUK3ITy8jh8N6ZN:JKDBxfQK30ON6ZN

  Score

  10^/10

  xloaderp596loaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2