Extracted

• • Target

    5f475f3f7c27c744afe9f860d0e0c93c6acabb6eec8a222118a498d0f8816a10

  • Size

    318KB

  • MD5

    7b3ac47b7e0a3b84ae5a4a34c3b37503

  • SHA1

    6b73e3bcff26f7b9d805bdf839271478e10d3aa9

  • SHA256

    5f475f3f7c27c744afe9f860d0e0c93c6acabb6eec8a222118a498d0f8816a10

  • SHA512

    dcb5b2ee9a55376699a733be65f8fdc5f482d2305447c67341577b40aabc9d27b34a76beb328daf3478ecd23e47d2064fb4b419f89cc3d2e0673e0c755d11105

  • SSDEEP

    6144:TxDuIshmUqiRw6gPmFyggTDL40FbL5COzewlSUeGaSH+g:EIJ3hg9OHJCOa4FeGaDg

  Score

  10^/10

  xloaderb0ardiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    sekfuer.exe

  • Size

    175KB

  • MD5

    726feddb203f26ef36c573c5305d97f8

  • SHA1

    0c88f5fe319fc16f18f924d57837c1cd8e1ddc07

  • SHA256

    6c1038acb3f2815c1e332a37fac58ec85cf3737a6e6792e2dbf6a0a2c0ed00c4

  • SHA512

    23ec28b39d0ab1c6dbc2fc2b9f7331a2610df03492522842517d41c52dffecf92d3ee688612134697495e5184f9ec8ac066e0b092eb637967ea5f220e83dd99a

  • SSDEEP

    3072:v18pICwxEy5y2Obv+AEEdu+tHixgAeHkhEzHCOpHiVn816Cz3D:vCJMVyCEoQjhzHCOpHW8

  Score

  3^/10

  discovery
  behavioral3behavioral4