Extracted

• • Target

    P.O-48452689535945.exe

  • Size

    521KB

  • MD5

    579c372392d600a9ef621ae4c1f7341a

  • SHA1

    e4fb160d99727aa5ffee784c9a5f52f6581704ee

  • SHA256

    f564f410274ccf48d4513984d1da95edefa874a555f5e7d95fae7f9cc1f46b6b

  • SHA512

    1c744f5d9b4bb04e0ed84bc66ad6a4970e2ff18da28a4c2b9910683821c6fe43ad585e22c56fbb26e1c0db547c7e58d432ffb9c1186da81b47c7f13e7335755f

  • SSDEEP

    6144:0uq2lrmbYS9j7tCiyEKAm63z9EZgVY+RQbwesfqFi/mpZ5bjf9VAZUUryjzbi:0WCbYQjoiuM3J0CyFzxVAZnreXi

  Score

  10^/10

  xloaderh3qodiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Beds Protector Packer

    Detects Beds Protector packer used to load .NET malware.

  • Xloader payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2