Extracted

• • Target

    aa9db27b2063f5aee9f97d7d86b883686f51bd030d0b38d6daaed3629a230a7d

  • Size

    271KB

  • MD5

    f9a20cce97d6efd9e8d071420a8858b7

  • SHA1

    17680094e9bdefe2f5205729f2b55be2ffca81fa

  • SHA256

    aa9db27b2063f5aee9f97d7d86b883686f51bd030d0b38d6daaed3629a230a7d

  • SHA512

    fb9055d9f19788e0c2d25f3f400165b630ef6f62604d6ee6a764c7a57f5f115737db4187be30641bca16af11d84d3afdde73b0790f5d43f682e10439ed7a1026

  • SSDEEP

    6144:zjg3mLX/fN+E4YQaTjiqyYUhOFjuYCN+E+2H:o3mD3N+E4/m4/SCNr

  Score

  10^/10

  xloaderp00ndiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    vvywdeos.exe

  • Size

    70KB

  • MD5

    f357de702f7b08ff1b60c2ca5bbdafa2

  • SHA1

    bc9e18bfbb4a9ce14351dfdffc3f57d22b40831a

  • SHA256

    9b4b5b5048151f723ca57f67e9107e24c844f1be62b977efaeabedb5d620eaf5

  • SHA512

    9b096e239c01f7bf7c946719deb3cadaf206ebd29530cf425a885e7351286b5f010b3fb66a3d55cef5200f2504ef76648789ec95a4935a6ea59a8f51280484d8

  • SSDEEP

    768:Qg0IfqrDRmG6yfW/b/EG8a7D3u/9W0VSpi3nDNKtc8WjWsWjcd3zeoUBJoqRwxHu:3bG6cIbqa/A9Rngc8DsWjcdDEH6H

  Score

  3^/10

  discovery
  behavioral3behavioral4