Extracted

• • Target

    5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118

  • Size

    2.4MB

  • MD5

    5a53f07640f66b7e88ac3d0b4acd5f9a

  • SHA1

    f8fbe7bbf85d97e557257c9fe09414a804da4a36

  • SHA256

    842898cfb97f8c01b55ea1aaf32ffffb5497e1dbe6ea309bfa715e37212bb6da

  • SHA512

    c0de15838eb3f87f0846f6c132db4e7c31630092d8af1552eac89a9f10cba3fd06373e0768f7504814c9728716ceaa9623db151a0b7f41354bd23c5d32b61242

  • SSDEEP

    49152:uooZ0ajbQzlq5O+l4QOnn8jeX+l8uvlhfNf5lWLPNyeL9+hw/USGy7Xk/51HwgGQ:eX0zlC6mJ98BVF/Q1a7

  Score

  10^/10

  xloaderu2kmloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Beds Protector Packer

    Detects Beds Protector packer used to load .NET malware.

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2