Extracted

• • Target

    931678c464ddfa2b640003aa86be1d8e410ad20e5d833ecd4955116bc21f7f2b

  • Size

    443KB

  • MD5

    0cd0ac4ac6acb3351f2d9fc26a71bf1d

  • SHA1

    c8829c949b6cb82495108878b041c7f2d50d48ed

  • SHA256

    931678c464ddfa2b640003aa86be1d8e410ad20e5d833ecd4955116bc21f7f2b

  • SHA512

    f6d67c2c5ed7a41f7cd748e413acc66fe0346ffcd8607e3a8a49f0d452457224d5f79e5c61fbab48b5e05be4d8a86fe6ff535700f7e2bb6bd5ee762d80753c78

  • SSDEEP

    6144:yGiU9eX6KKKKKKJEKPMlGWj6C/7Pf7hvJnSKywZjR896JHdpKHoLykp6a:eX6KKKKKKjPMltj64f7NJ896JHrKYJ

  Score

  10^/10

  xloaderhf9jdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/hkkeuk.dll

  • Size

    42KB

  • MD5

    70f300abbcb7565f8b2fa095839602c2

  • SHA1

    b0c1536216eae6182a625126494fc69fb2b8c826

  • SHA256

    c29deeb91e029c0325c2faf1fa6e8d9c71854dd3b640b4d6301f3471f5047971

  • SHA512

    fdad93927eef81f761f7644b8d9bf6a96ea6b681a63b6d47989266d745eb9fb7ec6cc2103dbaa9adf565714c40ca3abc192c93181e2c70e56b793ace22fef2c8

  • SSDEEP

    768:xxlHMNBHJ2AMl0srrDH00XNaGHb55Ibnsp4EEG8cckN:xs2HIbn9NG8s

  Score

  3^/10

  discovery
  behavioral3behavioral4