Extracted

• • Target

    c34886d629b199ebcda6f6fef7fcbf5f48ba3153c6789708639b0c37d4ac5487

  • Size

    304KB

  • MD5

    d5949e2ad723b184d5622ce746b0177b

  • SHA1

    10f1ec8f4a1ce70546a4ca25965b606ea2bc20ae

  • SHA256

    c34886d629b199ebcda6f6fef7fcbf5f48ba3153c6789708639b0c37d4ac5487

  • SHA512

    9a98a61a1c4f9a072ca9a809c6d582afd02826a449cfbdf58422b0e5dd7886acad515eae1a575e1097e8445eddc9d648592b62ea3560c51f008a235a1b0fa6c2

  • SSDEEP

    6144:RNeZ2KnbGYu/gc3BOsNExg7ncENT33uRh9Y/qAMJJdLZ+cb4YO:RNpKnyXgcxOsNEEcENT33uNIqbJB4cbW

  Score

  10^/10

  xloadermwfcdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    oryvzibei.exe

  • Size

    4KB

  • MD5

    0361a9f359f0e790728f7233f15a24ba

  • SHA1

    316941b24d00b64baf38a76e3a44596a6bdbef37

  • SHA256

    60b3f54da2275f4e7062a18ad72b413db3826d00170a859ec533fb1328758594

  • SHA512

    40bb782aff60a54a88a0d0424a6636e6d738f500b491713547c8dc43e69360ab002cb644325537e3eebacc78be654f211c93467f6fcedb603572e2ceb20ec128

  Score

  3^/10

  discovery
  behavioral3behavioral4