Extracted

• • Target

    9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118

  • Size

    256KB

  • MD5

    9b8f96489ef491a4378ae2552ee9950f

  • SHA1

    276b5857cd4b0b4289660efa6751821df93f374f

  • SHA256

    5852e0b1479d914e16a2f1cf21d61ff4e1f3d35b6fa5dbcf0055cfc2c9a89936

  • SHA512

    7bd616157ae2c8021434937438fbcff60c139aafbb31f8c9b431925ecc2543af16216236557ba32360c784a6a65ef86f1e59b5a2fba47602035b9569731eac9a

  • SSDEEP

    6144:F8LxBsMM0ev4yAs/lCDDtCupqxt9smUMHoeE/ZRPCb3tk:/lQuq14xghR4dk

  Score

  10^/10

  xloaderycnddiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/vksn.dll

  • Size

    20KB

  • MD5

    e34c52bba24db2908916801f8e39b7a7

  • SHA1

    d58cf73e0993109a2cd0a07c980682337186385b

  • SHA256

    e203779a905288614ca814693eaf5841c2213ca6c9f2e6d127accbaf69e84c32

  • SHA512

    0e5abbc376c252936fb9ae149d000aa15b971d3e49b8f224a3789750f9ccbd1d399ceec28318e4e34d00577ed4140baba6fbdb8c57f33f6fc43131bd2c036436

  • SSDEEP

    384:bmgOuiCzcXBWIOrJ0mLQrVTqyYVP74ovLwZRNngH8QvlN:bvOuiCzOX6cpjYVP7/z4Nw7v

  Score

  10^/10

  xloaderycnddiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4