Extracted

• • Target

    PO#11112100012.exe

  • Size

    259KB

  • MD5

    7c29d861a4278a75167c4b6823441e25

  • SHA1

    80fa2a19eed6387b5e20b025dc9d3bf062170582

  • SHA256

    956c96cbe30f2740b410c770bfe2ef855154c129afd48bbf34568ab872eb8988

  • SHA512

    117fda8fafef9dc7eed8b644d1c13ccadab8b5f451df0639e13b2b6877444ab6bbbe26e24ef3afa269bd946ae581be9bdd5639834866f0da2293d1b393175df7

  • SSDEEP

    6144:rGiXAwgdaEpnfKqEuENir0EWaIxkGnrmr:j0aERfw2wa04

  Score

  10^/10

  xloaderrgv6discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/jdzq.dll

  • Size

    34KB

  • MD5

    3cbfaabed5bfdf7ba91b2239ff4f54ae

  • SHA1

    f135231f2966ef23161b8744cf5c4d321234d1e0

  • SHA256

    369665e2448df9c8a1dce71ca14a508f4767ee7b4a141a39d662fff5a523a1a3

  • SHA512

    a4a9bddc5d0c805f15974dc5b975196f9af26fdf8285c6d7ffbdcb22f3529d44863e8616cb33167f0b3a456e07cbd71fae3916b1c0c792317f36b90565e6184d

  • SSDEEP

    768:F+Fegdn2Nn9Zee2WcRUHx7cLemtcuRAoTGgV:FXggN943WcRywem+uRAoKgV

  Score

  10^/10

  xloaderrgv6discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4