Extracted

• • Target

    7107c22585cca5ac62b9fe39dbd9daaa_JaffaCakes118

  • Size

    338KB

  • MD5

    7107c22585cca5ac62b9fe39dbd9daaa

  • SHA1

    f0ec4ac5425b96d44725d6530527aae591f5ad57

  • SHA256

    07f0dc41af2d35f2cdddc5e1d2e38b49db0dbfa7a80840633206c77002d019c8

  • SHA512

    ae1211188cbae541f5f6b349e5750f838a9502f8ad8abac7ce1c00d2888e855edca3d7dfbffeb833c17ba77dc9c18f47731c138fb178022267bc1aa69aa9e200

  • SSDEEP

    6144:yl9bet/TLOCbWUyoEmxIlhM0fwZ+4FMxlJ/5OCVdKrLfF0lYmuQ4pf:yYnyoEmxIlhM0YZ9Cxlh5OCi/cYvQ4pf

  Score

  10^/10

  xloaderatt3discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2