Extracted

• • Target

    140c2a66e6feca66598f349391e11813c91e918bad57de7422e0531ab42a6117

  • Size

    192KB

  • MD5

    a43025a136bcc6af701054ed51ad8adb

  • SHA1

    547032f4afb1cb3b6970ba5a64234d20e815a3a4

  • SHA256

    140c2a66e6feca66598f349391e11813c91e918bad57de7422e0531ab42a6117

  • SHA512

    e6c9bd2cf29cffb3d318664a9525d6d56767d4ec482b6f38861b1f01d222a73228f4e70bc12b45f700eb37513a32d64616edf09e8b4df349e9a0aa36c7fe3f81

  • SSDEEP

    3072:l1NjcVVnLpPuqbJzk9y/Nsso8vTUa6wySNSCV1sPvhDbQh2k4hPwn0gSimGZ6P5u:HNeZFhbEaeSN91sP9baS+npwIn2nyR7

  Score

  10^/10

  xloader3e9rdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    rxyzg.exe

  • Size

    3KB

  • MD5

    64d3f2b2a7c95bc7051051fe34620dc3

  • SHA1

    1a089f830583bca8aae69330a9e4946bbe03fb4f

  • SHA256

    d1595a226a32172f214ff69b964281ef663079b6467cffa98edc6064a9f69ab6

  • SHA512

    af6b303b98765034f886e8bc9889f829a0265bde7559b9e738ff310be6747be083c377fecc76a007d2f464907bff80c6acfc90abf7f46a1408438554a01bff7e

  Score

  3^/10

  discovery
  behavioral3behavioral4