Extracted

• • Target

    f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118

  • Size

    760KB

  • MD5

    f6e864629bc2117fb5cc3da3e33d6483

  • SHA1

    57ce16786eb6a4c49cfc6c794d012187a1ab7eaf

  • SHA256

    050249009735072542f00c432d35a71de4516aaee6fe7d5bfac1c8cda838e1f1

  • SHA512

    aba973473ba7dd58e7aa25a8ab17390f90b5aca627771b5cb1fe3d3cb0f88c5ff936dfbba7b1a71bd798ce68e3e3adfbdc2fc9e7eed2434150c6f377795a0730

  • SSDEEP

    12288:yuHHfYnbiuj4BiEOyHpBvygTUxiAuG0fEXj8l2hh/khmwizg:yunfYnbiuj40+pBvygA8WzC2hlRwl

  Score

  10^/10

  xloadernwruagilenetloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Suspicious use of SetThreadContext

  behavioral1behavioral2