Extracted

• • Target

    5a4d698774dca687006647cf8ae2f74c_JaffaCakes118

  • Size

    343KB

  • MD5

    5a4d698774dca687006647cf8ae2f74c

  • SHA1

    94cd9c7a16cdb81e407d6f3b5f86ab7f78f198b2

  • SHA256

    6ffcc0ba3c226b49b67548dc794b8f15ffa4819c71db0141a79e538567b90916

  • SHA512

    464649d25067e9d92d3827a5059930ba3f92cd8585a456361802e99b55acf15993b3d8e96fa34e2e4a535223458e21e0f3c406f3633ee3409a6dbfb524053555

  • SSDEEP

    6144:GJgNxGOhj+Sswa9Y8Vp5YsiTRA0BDw9Aa/zGGrBgdxfPoPq6mJxATu6XY:G+Zj+3rlIzBDYA8zZSIPq6mJxAKQY

  Score

  10^/10

  xloadercsw6loaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Core1 .NET packer

    Detects packer/loader used by .NET malware.

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2