Extracted

• • Target

    db2eaf0d8a8a9f2856d9a9b0cc9ae7c9aaf35c86_1648765408695.bin

  • Size

    242KB

  • MD5

    b4536ff04a41cb627463ed157b9c7521

  • SHA1

    db2eaf0d8a8a9f2856d9a9b0cc9ae7c9aaf35c86

  • SHA256

    144d8b9e77f9c36dbd271d84635cda3eb22b470dbb64e63b1e898041743918fa

  • SHA512

    c963ebfa9fcf119c4eef7f2c17266ce25b0e6e9554dac1da7e7098a7ff2e7af3c07cf70a913f386f2884208394f6035e282d128c59ded256d464b85d8fa549a1

  • SSDEEP

    6144:HNeZmCatx5SFXIcsCbeA79KHt8SCfqlmDwB/NCl:HNlCIx2XIcsrk9uyFwNI

  Score

  10^/10

  xloaderhxn2discoveryloaderpersistencerat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    pqnrmmq.exe

  • Size

    5KB

  • MD5

    ffe904bebf87531f8e5214b8b50aa7a9

  • SHA1

    7ef3ca140c73dce0c7de875493be90a01e60ec48

  • SHA256

    77f25d6adedeeefda3e4d103be5f19f1c227108216565a4d21135d31d5fc9e38

  • SHA512

    3091041178650aef9b2bbaeaaf2a43427eb2f17f5d79daf67d8f3d812e7a5f3ad1939b31b5305dba432703d1d634ff9a6401f4cc5a363b8c5762272b24ba2b50

  • SSDEEP

    96:B9WSoj4OORqz0l99c9bGupH5Jq76PITuWaYVRn:ws7qKybJfq76PIH

  Score

  3^/10

  discovery
  behavioral3behavioral4