Extracted

• • Target

    PI 4717_PDF.exe

  • Size

    306KB

  • MD5

    c14625cddc83ab7cc4d5bf559bb0b519

  • SHA1

    75d857ed93cb4c5ba2e2ec6c546e49c1695aac2a

  • SHA256

    acbc73c81f446276bb0110ac2a5d902d928556adcac4ed41fecff6671c818bfa

  • SHA512

    faa37131339a22782b4c5023c70d506dc8be0d19f44a1a33380c06670e5d15c93defa94254a2e7a7ca9e62d2693950cde4a3226ebd22b9ed757552618ef7250f

  • SSDEEP

    6144:rGi1YPNjmC4errA4LgFYRBvtCJ+DJgfRheS6tD4glttwcTTaTvzsErsZNC3azW:JOrrnLgFaBvtCZfRMTLaT76qH

  Score

  10^/10

  xloaderb4t9discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/yeorkzn.dll

  • Size

    134KB

  • MD5

    de4cd82a7d5710c0920e65426ca69cdc

  • SHA1

    f6f2644a63dfaca5e87d72f9b5bbabb88ac4b716

  • SHA256

    7f9b3f353d52281a4c811baf32c963950139aaac91c34dd02da510eb8fcdf330

  • SHA512

    e4b8941eaaf2d4260fc3ea7aa84196d473b6e6ebff3e253bfe1c899f3f97803d98554abf52af85c84a6278e58f06573726a0f80ede272dd6eb38c8de4bee1bbf

  • SSDEEP

    1536:riqBVCUCN7r8Aysu0NFwofM5uyBjFwla41chyVbbkyskbdFtKlrVyi95+6Lwca/j:ri/7r8AFNjE0GQchyt5EFIAZN

  Score

  10^/10

  xloaderb4t9discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4