Extracted

• • Target

    CTM_50,000.exe

  • Size

    324KB

  • MD5

    0745a91ca11c4c208560564ec24451d7

  • SHA1

    cd7d14c1b17841b118e4e1f1fc473612654f2f31

  • SHA256

    4796e12d5a33b3b717b0ddc65286b9de7479e86bc91cc0bdb843722a5b62951b

  • SHA512

    dfcf69496dd86e8e5d379c530899536a7a64c0ed5b4c05bac8282fee655541ea4d69df80e9d41026d260118825e8e0cbb64e8f8d2fbf0d1e0f868edfe72a5466

  • SSDEEP

    6144:oBrf0xh3Hfr5YwuLpVtE/qpDVl2HwW429mdix4KRYLCeA8ntOOrdT0y:+rf0P3HD5YQ/qp5UHwWmix4TLCQXrd7

  Score

  10^/10

  xloadereca0loaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2