Extracted

• • Target

    638b6ebd151367c3edb3c71446f69dd7_JaffaCakes118

  • Size

    832KB

  • MD5

    638b6ebd151367c3edb3c71446f69dd7

  • SHA1

    940e938809b6cef36948df102cb4304969c2f58a

  • SHA256

    fd151f1c914b41e565c1dfeae2cab5c77fdcc885b83c46e30b9fe3eefc68efd3

  • SHA512

    8b5ad4d87c24bde0685e6f458597a3bbf3df1892c6de08e22c66cc7f84ff650ab2e7917cc172f3fa85917578a28749b7c2ad844e80b2452ee35c0d13d242b6f9

  • SSDEEP

    12288:G49Q4FR9/HK7zPxQ9l2hZQ9ixuWFECiUnQ5np6m2s94pcwwsqO9gAAu8WP3YxAEq:9JFuNG2hHuwkUQ2m2s9qNqOfgW/

  Score

  10^/10

  xloadergno4discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2