Extracted

• • Target

    66fd2bc4d1ec466bcd76e50bbc959b9a794e897345e69305e11aa99d0b0d656d

  • Size

    357KB

  • MD5

    b99e10d4eb07e4a986ee92bcf444a7bf

  • SHA1

    470d703ad9ea51844f0577d917f7167cc032887d

  • SHA256

    66fd2bc4d1ec466bcd76e50bbc959b9a794e897345e69305e11aa99d0b0d656d

  • SHA512

    4914d79035dffa9ef00dc79ac756957a3cf686af41e414836ae0500ec1a9c5084cb77b1a2c1f7ff203d77b9f7897f8de3b38c1aadb36c68aa92d5900b18096b0

  • SSDEEP

    6144:GwvDTzJ2RxyyZkZkMgGpHL9lIXJSto6BYvF1p7a0J8GM9p9MS:JzzZuMgGpheJSesYd1pR8lrR

  Score

  10^/10

  xloaderpoutdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    nwixhieg.exe

  • Size

    118KB

  • MD5

    ac46facd334c7cd106cde9fdf38e965c

  • SHA1

    daa001174d595132938cfc19c43579cbd4d082ca

  • SHA256

    c1d018b4850721d1a602b7aa0273ef1e00d962199167f1b09465a47daff31b1b

  • SHA512

    f546345984e3edb7651737306201e8b5a5d76c4b508170fb998ecb16245846cc3719052390aa47ca2b862bc0bbb5ae4174ec9605f5fb0c91758c4aef4092805e

  • SSDEEP

    3072:Ua3JqHFiR0yzs5xdhSHaV3cEASRHNrOG:UVHQR0cgxd8Ha8S

  Score

  3^/10

  discovery
  behavioral3behavioral4