Extracted

• • Target

    f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a

  • Size

    352KB

  • MD5

    fc7eb63804088472b1cac1ac9fe5d16f

  • SHA1

    63205c7b5c84296478f1ad7d335aa06b8b7da536

  • SHA256

    f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a

  • SHA512

    57c0dcf7689e04e172d4adfdd6295618cb5695034739a4c57d0fd871b864345e54dd05ed5c3475579ff742c947202618c59db0ea351f52521e1cf7622f007734

  • SSDEEP

    6144:UwxU76BJzteu9g8LJId0ER61it8LeZf5sm22UPLwkkBPPmK4vQniV:JU74eYg8ddER6C8LCKJ6PPmJvQiV

  Score

  10^/10

  xloaderd6cddiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    ktvrnf.exe

  • Size

    117KB

  • MD5

    918b5b3ab8c29f68394eb7017a42aa85

  • SHA1

    1a783f39a9ed81412bc018a0d54a116bf9de3277

  • SHA256

    b4e506d84bae993428232dd52683753944461f639b7228639be20000563a96e3

  • SHA512

    4a50d82e01690f12f6254f31f11db1fe69d40891b84675d4db25b55b90eb58a078ddafbeb125330df7dec31c6d6af752186ba57a05fd9eb5b6592b636885f672

  • SSDEEP

    1536:9oMraTSjiYFwlvwVC1TsJ66zafChiCLfgOKRy0Ez4w8/GrZc8oA5YfnsWjcd7on:XjFwlvweI8kaZQvKReHXmfIkn

  Score

  3^/10

  discovery
  behavioral3behavioral4