Extracted

• • Target

    2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67

  • Size

    423KB

  • MD5

    f4367b0139952a0f2cf8a669484f35b9

  • SHA1

    d5a34c1fe6fa4ae0d9430de94514b150041df431

  • SHA256

    2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67

  • SHA512

    330dcbd55d7fa54aec5ab99cd559d414db585bfccd5dcb9a307796d6541ce781e369423042b8d6f2f8c7059a265a78f75f42748e40aa73aa438ffa762bd80449

  • SSDEEP

    6144:9wVQx8ayrbor77JaQOCzixo3wFnK0+pDp2WyULR5z/ug:JxPgUrAQOE02h1bTzWg

  Score

  10^/10

  xloader0pu8discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/hvlovmp.dll

  • Size

    4KB

  • MD5

    326a702abb396435221880fd71450249

  • SHA1

    62f5a8e24469859250a5630e5b9280b8472e5a56

  • SHA256

    f936817179febc934e8fa271aac522f989e6a6b43ebf42a44588f71ecae79042

  • SHA512

    3018fa492ecbba49350db3f93df5f20852a47dd363315704737b2abd9c70bf86cc74858572a267e7fb79f8590c064ebaa0024ac84b41fb7fb684a3c23f7da615

  Score

  10^/10

  xloader0pu8discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4