Extracted

• • Target
    2575df47e8e09da1f99edde3c9533468c1c76e271e354323bb410aab1bd5f02f
  • Size 244KB
  • SHA256 2575df47e8e09da1f99edde3c9533468c1c76e271e354323bb410aab1bd5f02f
  • MD5 ab56d27ab05f380a166ee2b9409a759b
  • SHA1 8fbda847f0969523042a9e9a0e1b2ce36e81d749
  • SHA512 6d824d2b1fc82298fe4b6d5bf735f3c88c272ed42134396a398481157812e1cd706ad915da4a7e64c7941e1898bbb0c8cf6c92602dd976618c270602e4a4a334
  • SSDEEP 6144:rGiK7P9Xjv4UPOth6tT+fzQrEdGUzlAsLRvDkE73Fb5iptZx9s:81XjO76Z+srE0URAkv7Gpt9s
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloaderrbrtdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    qmhzftyxd.exe
  • Size 4KB
  • SHA256 f7396efdcbc39e94a112ca8086d845b52ecbd9195516c9c9eff55491eee9f664
  • MD5 2281c1ed86f831c1fe3e0e9605f27b67
  • SHA1 492dce2fdc0859857277e4a4ac3b9bd6eb3cf966
  • SHA512 be68d2f3eaa905172ebfc325320d86143ea84f31791b348a9e3b7004d3b2dc4c499f7d5e0f19419ae2d7be0d9277ea69876784214480dca120240abbe60ddc36
  • SSDEEP 48:S+NGKNw3WqIvYoPPhCO3Rq7IOdCVTnmquFRuqS:ZdqIv3pRQIOUVkfx
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4