Extracted

• • Target

    e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862

  • Size

    369KB

  • MD5

    e4e56f7fefe037591b5115092d6ee990

  • SHA1

    b8d25f0e321c32e22af6df64d513c1d88e9f592c

  • SHA256

    e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862

  • SHA512

    c90369ee2284a101d964a850bca76f18608eed6c74c6f38f4e457006a227b9b504e22ebdddaed267e69293d98fe1e2d7c9f2e18fc213b1aeeb55243a4295dd02

  • SSDEEP

    6144:c8LxBD6v9qhYrE2Z3igLitp6ULh4UG+y63WzaHV4KTL6UK46cbpJ2qbglQA:XYrP3X0p6yGB6Gza4KTj6Up5bglH

  Score

  10^/10

  xloaderdhuadiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/nbjkg.dll

  • Size

    38KB

  • MD5

    ff488c7d8f8f03c34e67a7ac3ebeaafe

  • SHA1

    bbc4aacac09047d12f6ea5b54a24255e9389ba0e

  • SHA256

    b6f7a133237e590893ca7e6aceb76d96c8bfff8c767dcd4db53a57b366366dfa

  • SHA512

    9955013d4f601507ab35453a5b38063cadd2f75946ed998169d7fc42fe133deed31a0927693c8f131161df5281e0a2499b2b37359f7662b3e948c2cf407e11f1

  • SSDEEP

    768:iNQs0OCYx0PV+EtiuxNs7sTHrHAm/N49v2PtyCjQphC/5BlfB4We8wCX04e7Z8Ym:5hOCggNsudB4We8w54e7Zhb6

  Score

  10^/10

  xloaderdhuadiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4