Extracted

• • Target

    Sparetronics - Line Card.exe

  • Size

    790KB

  • MD5

    0d15a3865c8e7c9ff7d9632969281f45

  • SHA1

    3794ebfcda17346aa11f6a56ba05ed4ef1105642

  • SHA256

    aac488250a4059c3a5fe215e9d37649ac3666e1acb0ffa9031d7a5b171f951e1

  • SHA512

    2b1198db896cf56ee05f1ecada8da7bc809557d2364d92cadd9c64d2c573c2206cdd8b5e83b7ddc60ce15f1374eb8eeba139bff6656d1fc268a41176a1b91f4a

  • SSDEEP

    12288:rSskqu7Es0xrVHB2kDRkAU7Ed1phEnUJp058NxjzCrwW7ZG9sVbXbs+XPgDdVAad:msCQrM74d1phEU48nCLss54dVAanpo

  Score

  10^/10

  xloadersbjqdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Xloader payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2