Extracted

• • Target

    916715cdd3cb9f6670424bd4f72682cdc4343d79fd36b19de992ee2c3095ecdeN

  • Size

    307KB

  • MD5

    28f2c3e63f1fd1357d2cfe72869b53c0

  • SHA1

    173d8ff1943f864ea06ef27921ed0e5e2216666f

  • SHA256

    916715cdd3cb9f6670424bd4f72682cdc4343d79fd36b19de992ee2c3095ecde

  • SHA512

    c1fe8d6e948521b9d30e4275031b1ff2a2ffb4ff5bd1b0214e631cc4efe3e2613d3edd27c437329edce64f09c35721cc132604c9c2631f2c0269c7ad7a9d9994

  • SSDEEP

    6144:RNeZbN827N5wptBh8EF6+ofNxn1g50EG8Y0lWNe7I+4auF9PX:RNONvJ+ptBCU6++gr86I+69PX

  Score

  10^/10

  xloaderop53discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    xuhsbsshb.exe

  • Size

    4KB

  • MD5

    daa39e25fb5b25bd1e42408efdac928f

  • SHA1

    665426ddf94268322d180128a92ddb2f45b1d3b8

  • SHA256

    7e5a0ec65f4c96a6b8de07c341282da8777fc45f4976e415f1738fa165d0a272

  • SHA512

    42cae6cc93a923965a65b70c68a46e63246d5af0175cbf7e4fc33ecf8d5bd2ffc1395c4237411292136daf36ebf132567cfa2f6dc2a7ec7d33d482cee2cb4903

  Score

  3^/10

  discovery
  behavioral3behavioral4