Extracted

• • Target

    fd45ab42cffc17209261bff2430c8245_JaffaCakes118

  • Size

    821KB

  • MD5

    fd45ab42cffc17209261bff2430c8245

  • SHA1

    d06143966b8ca02db582f5111fc275844796786f

  • SHA256

    6afa5e287f69f392b8481a94ebb1729c606a1f1023820e79e942ad40dfe96859

  • SHA512

    c6326b0d3f029bfe7b9d2cee32b89dee3b46b921af5f342958971d5c5be4e2be6fd9d3ca518b5215f6f0a3572d4f739922f1f7392c67acd1967c42d99145252f

  • SSDEEP

    12288:vMrP7wwt12QLaX3miWy4hTniOHDA4HnIsNGEG9gfy27ONd+5nDCZ+ug3vI4SeZ91:ErP7ww4V4h2wChgfVu8q7mo5oFCEkv

  Score

  10^/10

  xloaderm6b5loaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2