Extracted

• • Target

    de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe

  • Size

    253KB

  • MD5

    7617f0f2072861162d2ef62172fabc6a

  • SHA1

    43c79b0095195a880dc27e20d7f441ef5ed38e79

  • SHA256

    de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038

  • SHA512

    49cb71215ecc557354d4690331ca74b270cdb6647362aa04a959aac81269562b1fc28992ba153a2a98c038f8239cce8698ebb37771389ef278b80915b965baa8

  • SSDEEP

    6144:wBlL/c87eYm2Qs7omGr3zFBKC1pJ9r5MMApfLkme:Ce6o2Qs8Rr3zRpHr5IjK

  Score

  10^/10

  xloaderkqnadiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/oirygpbyia.dll

  • Size

    38KB

  • MD5

    6d2a0ca8aac6594e4f037d3cecdace3b

  • SHA1

    2fdc815752d2483ae536ed60dd2104b0e5cc2abd

  • SHA256

    f7a3aa43e037f6b25c8070b3aaac9f0c5037abb1c4d01afd30a6f52f7c44f468

  • SHA512

    cacc25100aedd926141416ef443dd40f03cb6b1512129bd707fc8ece1c9db2ad9a1de559e8cb3d29b569e2b1b843822f4ef681c4ea33bc5a6a290a3f17bdb7ee

  • SSDEEP

    384:g62dM1YJb19+21X4qFTrtR1836QFlqIknaqRCz+7+TY2EMfENSC4dlZ2dpwr:g6Ly19+2NFTJ7arFlRkKTYrGzIpwr

  Score

  10^/10

  xloaderkqnadiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4