Extracted

• • Target

    SOA.exe

  • Size

    263KB

  • MD5

    baf2982217b31a6fe69abf4008f58329

  • SHA1

    b8dadf51e395b219e7300ba5d0e95fb9d7d9f509

  • SHA256

    40da3a76d7dfbe395b879dc9b090af73483617c65c7c433975490c0a22e4a71a

  • SHA512

    d7aa8d2409c77e29e58ed79ca0539411e3323dfa32451f1f5bf6580f8d375a2756a7d0c0647a301fb2b002bdffad7797d27180746a4154a0c848589c0bd35f4e

  • SSDEEP

    6144:l8LxBjFO09nfR+z/ZSGoxaHGcLFBZ/uxap1Z9EfbNdVE:0FRnfMz/Im9fZ/uwxaNdVE

  Score

  10^/10

  xloaderb2c0discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/qhcv.dll

  • Size

    39KB

  • MD5

    6d70c6175a3d7e78b967d0f8f349a17c

  • SHA1

    35c22d80df2112aae34e567b6e28a3d969f23e3b

  • SHA256

    1e22878a69afeffc681adfcb5fbb6772821bafccd966b72da2e3ba195595b735

  • SHA512

    6472e91780238b1f47c86c5d32e238252b840619477c5c27654b99b617af123d30eb4d64336e79cb65bca6e1878c6b9d6375148b0e68ccb178c4893023eb87d2

  • SSDEEP

    768:JMsHUlNQ80Ocx0P7+r/ti86Zs7sTHXryAm/u49o2PjK4tqPAyck5x7VCSWfNKAnr:zhxOWrODIYASRCSWfUk0H7ZJTS

  Score

  10^/10

  xloaderb2c0discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4