Extracted

• • Target

    2575df47e8e09da1f99edde3c9533468c1c76e271e354323bb410aab1bd5f02f

  • Size

    244KB

  • MD5

    ab56d27ab05f380a166ee2b9409a759b

  • SHA1

    8fbda847f0969523042a9e9a0e1b2ce36e81d749

  • SHA256

    2575df47e8e09da1f99edde3c9533468c1c76e271e354323bb410aab1bd5f02f

  • SHA512

    6d824d2b1fc82298fe4b6d5bf735f3c88c272ed42134396a398481157812e1cd706ad915da4a7e64c7941e1898bbb0c8cf6c92602dd976618c270602e4a4a334

  • SSDEEP

    6144:rGiK7P9Xjv4UPOth6tT+fzQrEdGUzlAsLRvDkE73Fb5iptZx9s:81XjO76Z+srE0URAkv7Gpt9s

  Score

  10^/10

  xloaderrbrtdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    qmhzftyxd.exe

  • Size

    4KB

  • MD5

    2281c1ed86f831c1fe3e0e9605f27b67

  • SHA1

    492dce2fdc0859857277e4a4ac3b9bd6eb3cf966

  • SHA256

    f7396efdcbc39e94a112ca8086d845b52ecbd9195516c9c9eff55491eee9f664

  • SHA512

    be68d2f3eaa905172ebfc325320d86143ea84f31791b348a9e3b7004d3b2dc4c499f7d5e0f19419ae2d7be0d9277ea69876784214480dca120240abbe60ddc36

  • SSDEEP

    48:S+NGKNw3WqIvYoPPhCO3Rq7IOdCVTnmquFRuqS:ZdqIv3pRQIOUVkfx

  Score

  3^/10

  discovery
  behavioral3behavioral4