Extracted

• • Target

    5b4f0a86299caa8167044e4c66254290_JaffaCakes118

  • Size

    365KB

  • MD5

    5b4f0a86299caa8167044e4c66254290

  • SHA1

    42a66629f75716d56790a610c404294e288224b1

  • SHA256

    e6cde5c1b614549613d30761b34c899f4ff69d7e6e3147c21d68bedd64f8fe25

  • SHA512

    3fecdc807f1b49a94794f5c37883df9d8fefafa63c94fe8e6fb3156cc136a1f5b50e601e0f2cd2339cf1830a31b2bb7eab25f281971006d4609fee2190755646

  • SSDEEP

    6144:c8LxBD6v9qhYrkSm7Yn8RYzf1NBpHxehm+XeM33rAyrV3YNriVEXHU:XYr9mgCYBjrGX19Ae0U

  Score

  10^/10

  xloaderou3tloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/feczzkflxf.dll

  • Size

    30KB

  • MD5

    895a48f7b6d967eb813de8f96b0aca55

  • SHA1

    821be080225a3415d6db2e6b269e841b0605ad93

  • SHA256

    f00a637108b667cb6fc1c265c6e0fdcf650156d3100a6de084d430971ed03393

  • SHA512

    5acd3940d4f55124c32a49325bdc8d59f2805882ea2c43b9b92db95861fb19ed3971a98f82cf3fffae42c2d243dbe2aaac05f50760adac4afd6a4065374dca60

  • SSDEEP

    768:nYYsBQJDh7wN4Ce10NUW5gPO8P9MOVnF06ZTt07IKt:nIBQJDPGgPO8P9vnF06P07J

  Score

  10^/10

  xloaderou3tloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4