Extracted

• • Target

    IMG_501327.exe

  • Size

    462KB

  • MD5

    1f11cb76d8f9643820a756448b4b3a0e

  • SHA1

    c00db72ff5681b1f26db430a71b35dcfe3978d1c

  • SHA256

    aaf1000d1f4822bb6e7424123c807a333a8696783ab029b49df8250b115c27ae

  • SHA512

    2e1c2c46233b1a995e234ff7dd5a876a2230e06dc5ee6da3fdd3a890ce2f43bb57e0faee14c3094c80d99f435d42b7e13c845d885f82c2b2d31961cc1db2b3cc

  • SSDEEP

    12288:pFda+FdagEMYLZsUN8dgHgY8RfuydvDZ0da7Af:bEMfrdc8Zhdd

  Score

  10^/10

  xloadermt6eexecutionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Beds Protector Packer

    Detects Beds Protector packer used to load .NET malware.

  • Xloader payload

    rat

  • Deletes itself

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2