Extracted

• • Target

    cabb80e60885c678211fa4a1653e92f98d9383ee9c31b2576ec507153585d477

  • Size

    304KB

  • MD5

    c9070047ab2475ee0a972aa35e607d6b

  • SHA1

    c6147247f9f048a4260293c3ffd38504f47a3e7d

  • SHA256

    cabb80e60885c678211fa4a1653e92f98d9383ee9c31b2576ec507153585d477

  • SHA512

    fbb9c1f00c4826ee08e04b864a2b84fcef0c1935a258dd229173170cca52d0d364c48cb9de458b89ea1f41811fe42dea3549ce1aa34235648902b7adc1e239cc

  • SSDEEP

    6144:1xDNXvMZdAkGun7Q4cu7uTpBz0hs9V4SGrPyQaL1S:xXEX9849uTMhA4SC7aLg

  Score

  10^/10

  xloaderordvdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    xbgsaxgvtq.exe

  • Size

    6KB

  • MD5

    2ba1a350b5a4deba2dd52d84c03534b4

  • SHA1

    ba6baa55c68ee4b7979ee3fccc2c54878c705a2f

  • SHA256

    95ecc7f27ad29fed67b107020ab9291ec6115bd6a375306331de7d98deda578b

  • SHA512

    5575e7e591f3f3e6dc461f8ef9203decc1c1295f9588b70ae9c2e0c85bf7116b60ea15718cf3875969b261aa2f8e874bc361bb5130b5c7e3bc2aeee2797dca0b

  • SSDEEP

    96:5PWQ9fzIvSgdlgKV3LcOs6Edfq/VhB9oPOoynKx:RWQ9WsW7VbE1wQPOoyn

  Score

  3^/10

  discovery
  behavioral3behavioral4