Extracted

• • Target

    97ea9eb9abdc300ce758c07ef0a31854be8342969bcacfc458e642540b63d63a

  • Size

    251KB

  • MD5

    97206e8b31ee16ef3d47eab75ba0c9d5

  • SHA1

    c152b70ac2a5a2fbdd38439eeab9b432339dc381

  • SHA256

    97ea9eb9abdc300ce758c07ef0a31854be8342969bcacfc458e642540b63d63a

  • SHA512

    66b88c23d5168341299f0758bb06763f09d1ede5d8fe6cb7f397676f681fe5e233a87815cf5eef2bba3b6c6eaf4f5cb066bec1675b34f97745932a6fa31227af

  • SSDEEP

    3072:B1NjcVVnLpPunbR73LSVVcFeqcL+ztw9jtAXFUOpJ4BEeT6d9Eh7Q7Ql6stCEuhX:bNeZmxNtcLkw01FuBFW9i7sQ8uTxPoRz

  Score

  10^/10

  xloaderr0kudiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    glmvoahjy.exe

  • Size

    4KB

  • MD5

    dea5c229f2b9623e29d3236d26da3551

  • SHA1

    782235d5f7991fef92f72ad3aa045fc1105708f3

  • SHA256

    c8dce5a38599e3e4929af394c86710593dd84388e18ee9f512800685c909d2d8

  • SHA512

    4a3aaa23d5ea3801ae64ae71d7e3824a8e3f817d61c617619c31a3842ec30668c1d0e1729fe519315285132664ced11a558a30e1e06e48c457840eb9a9573e94

  Score

  3^/10

  discovery
  behavioral3behavioral4