Extracted

• • Target

    f5e06eac210ad2965522d958281c8c95_JaffaCakes118

  • Size

    733KB

  • MD5

    f5e06eac210ad2965522d958281c8c95

  • SHA1

    102aa3b2f0a0f032fd4f830095617674be963525

  • SHA256

    94ec59e8f70de9f2fc9a4774fc7ed32a7a0495115a813537f77c9aeb505a5bc4

  • SHA512

    3e7657b45fdd015d966c78e17af01cf204a6886b951cb66960effbf8b35dec2e5927eb88f71cd272d27ce8e1f7ab9949293ecf0091747b9ba9a4970a33cdce91

  • SSDEEP

    12288:yX2fYp/cCOsBgo0q4wMRYSyKDpbeE9/fJT8c0TXH/wOKviT:yX2fzCOsBgo0q4wMRYzKFHHJTwrHrj

  Score

  10^/10

  xloaderwufnloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2