Extracted

• • Target

    4e084eb594dca69ba8ac628aa74dbe43fe6032a71f47785241f72e1a52dff897

  • Size

    1.1MB

  • MD5

    3702c5efbf064afe0436e61bc355ca94

  • SHA1

    5760a5ed8d7d0b30e1c06530df6c6ef5a44de572

  • SHA256

    4e084eb594dca69ba8ac628aa74dbe43fe6032a71f47785241f72e1a52dff897

  • SHA512

    4d7e47565d3c9ceff0ec1ba1e7ae56abf85dec43511d362a4f3625b22729abbed0cbf3a32ba250b18e887535f2686a2026b32122776cf5435efd95396e3023fa

  • SSDEEP

    24576:TG4N0uzw3OvrnKuzTBZzPVT8EhMykjeSnqhXx4QbUIx1/3a+t9rGsWapUf99VVx:dN0N3ODrB5dIPykjehxhUIx1/q+tZVkX

  Score

  10^/10

  xloaderp1nrdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2