Extracted

• • Target

    rev inv07014.exe

  • Size

    190KB

  • MD5

    279122d3d89dab6a1b1a3a44931eb9a9

  • SHA1

    df6f4453f8540c7a0f26a69c07907b3880ef7ffa

  • SHA256

    758e43dcb865272b3fd6830e51e6875b9eeed7ad2734f0ceb4c5915c14fabb8a

  • SHA512

    1e50c1a2d64adcde4dadc336e1e5de7c1ac030c9f7185f45e9021c914415e676a05c89de23563d401ef853129c7bc30ca2a6fa4d181ee0c277785ca40d8d8ae6

  • SSDEEP

    3072:iBkfJpRXATwMdFCcGb/WfMwskKgw/01e7sm1QuQ1/oUsQSI4k0ZvSJlKVhrFz:iqjIKOfHsrD/01Esm1Q9nTSfbZvwKVdN

  Score

  10^/10

  xloaderymridiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    zwgay.dll

  • Size

    9KB

  • MD5

    dcc94fb3455b7726349f6b05f98a9f1e

  • SHA1

    ea2160715cddfde302043c8f69b63a3c03bc651d

  • SHA256

    3d3288ebb21a28f71417efa86b6a136cb37340f3542ce8e99b267c7b347f73ef

  • SHA512

    b3d6e8cae4d6e693b7b726120627a6815d7c5f29c51be26df041edb970727548bdb961b469ed74bc767ab2e27a6be5650122e2b968e81cca0571667277bd6305

  • SSDEEP

    192:lxRcBDJ0tI8S85DR8THYS1YNHgTs22FFVFUFF:DqBAxHzIHY0Y2TIrW

  Score

  10^/10

  xloaderymridiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4