Extracted

Extracted

• • Target

    Ord20211310570045368963AC.exe

  • Size

    585KB

  • MD5

    f6fde8532e45bb49f3220e64c10d11a1

  • SHA1

    4911c4d21a733ffa4990e2f00eab31106488fb85

  • SHA256

    536cd8989d73b24ec397f603f3b509ec656febd8273c78ec576c200b5d09d063

  • SHA512

    66931a5dd699970487164a434ce19e1ccaee8355cd1fbcedda9b3331106ed8e8b58d0a24c8272cacea29c5d930548cd324aa3c794186013398c5fac0f2805976

  • SSDEEP

    12288:2aZPkBSBo79XgtOW5nuRI/+cEchvo3LKUWj9zKCUFRXgHe:ZZPPBHttd2cEcQ3LEj9Da+

  Score

  10^/10

  xloadergab8loaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    Ord20211310570045368964AL.exe

  • Size

    474KB

  • MD5

    0cb1c28aaae7fb100c41281e5c9b6c2b

  • SHA1

    8e417c1400cac2182f5bc92457d34753e2f9dc23

  • SHA256

    966f2e804c9e63e6bbc3d7dda36de1e2ca1fb4b93b4fe95bcfe4b682399ca4ce

  • SHA512

    e8cb29368fbc13ef6a8b4e078b8310aaffc9845e73bfaa83e414b998548d9ace3e16ffa3e36efc902a43b1c36bf06fb909e81c0b5adc248da6cb05edc8896621

  • SSDEEP

    12288:lOPUPk5+jcIK7GaUv7WaFbMPiyOn8pNISB:lcUP++jcIKqaUjWmwJpNFB

  Score

  10^/10

  asyncratdefaultrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4