Extracted

• • Target

    84756d09ad2ebedc58b7a9c1f8eef37a_JaffaCakes118

  • Size

    922KB

  • MD5

    84756d09ad2ebedc58b7a9c1f8eef37a

  • SHA1

    e2bb18924f52e084f0ecd0255fdc756b52160aad

  • SHA256

    e8e6f1a8298545d8f56516375149c109f201c94738af99e65e4df71727d52d32

  • SHA512

    ce6937cc3ffabf76d9dc140561f4f10c91d3a1da5096d6f2d4f4987b477f7bf31368997d8cc34fc410d3a9efb5bcf2b14a63267245b1ac3af0f0d280f6566f2f

  • SSDEEP

    12288:d0NSB5IGZEVKhzObhW6qlJwIPH8iNK2GzZwKBx0IvhQNOgQc1Bh1Y+:d0M/Z9ot7qLNccK2GhGI56QcDhK

  Score

  10^/10

  xloaderoeandiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2