Extracted

• • Target

    REVISE 50% OCTA INVOICE.exe

  • Size

    257KB

  • MD5

    093048c24b9994fef2130cd8457e7a4b

  • SHA1

    f3c31eefe661b1febc80c0865af8f4fd1385ac7f

  • SHA256

    0e803b7715385244cae58772b5b0da43b7cca6a97c5ffd182081eca8676ff5d7

  • SHA512

    e95142b25ae3078c642df183213ed06ccb0b5b65c4b25c3844803258d8b149c3570fdd00a25b539199f44ad10877c37139e430febe304ad6860511c379d4a2ba

  • SSDEEP

    6144:rGiHxY9gDrwfI4pppl819WDk4UQ/FENd0AVT/+yIXg:LxYMrwfI8l819Z4UsFEf0CL+Zw

  Score

  10^/10

  xloadere8iadiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/pqcs.dll

  • Size

    33KB

  • MD5

    f2828be237823a888b96c7d265c0ec05

  • SHA1

    bf3b7ee29a6ff865fd6c17fd449cca42e4c6bc74

  • SHA256

    61591ac877c329a2b715066f957ea19c164bc78c1ffaf59c769462a689f3b139

  • SHA512

    2b94e24a27f47cac7494cc9a876e7f27a0f9a53b1a2be5e9f46efa94abd29287edae2de1784e387f28483dad99d7af12ac61e0fe450e1b00a1c5c1cdf32185c5

  • SSDEEP

    768:Z7FNffi2WH97ke2WdXUsx6wvemtm3XEnQO1:Znf/Wd43WdXJjemyXEQO1

  Score

  10^/10

  xloadere8iadiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4