Extracted

• • Target

    f841c72b1c4cadc4c98903ad26a96a16_JaffaCakes118

  • Size

    281KB

  • MD5

    f841c72b1c4cadc4c98903ad26a96a16

  • SHA1

    06359aaf42a5ce60889ab7a93d8af7702b34630a

  • SHA256

    eaa038a0020fee7ddfe2919203f20f15ca1d7eb19d90b168cade93b5cf8d7f43

  • SHA512

    b80671d608aab3309567326b552a969245e448cd272e635a74abde9082d455e11f9d264928c61647d4b52b183c85425d3933fcffa4093b4453463e295f768f37

  • SSDEEP

    6144:wBlL/cQMpuMEI8xf6S6s4SOTJoR6qMdayJ5rSFb1e7uuUI0vVLM:CeQMzEDxf6I8J3dTXuuUbI

  Score

  10^/10

  xloaderu9xnloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/xpbpx.dll

  • Size

    104KB

  • MD5

    4eb0e08649f542fd0e44bef7845956fc

  • SHA1

    5fac196ee8af08f8f954f3086c0250a905986c02

  • SHA256

    15ed84b6d171b6b6834aa6a39150b6165b2c83411929a8c6963b6e446df44ed1

  • SHA512

    de809b359ccd7b65b41fd8320a16793c74ae1eecfee3f25d8a9943ca4d2cda675733794ec944e11d62fcd0f6ad9a0bfd7748e74841c68c6796255235b3d0b68f

  • SSDEEP

    1536:oJUmgGAYhReTNsu0yGLmQEQoOoLz8I5EgZ2UlH08mAiI3Wklk9ncobUfsQzt2jwM:CUmgGASei2EAPP3xlkrEmP

  Score

  3^/10
  behavioral3behavioral4