Extracted

• • Target

    6e06b764495fc246c57c604363ccc21db72c8a4776660b852ee000cbe6a488a4

  • Size

    452KB

  • MD5

    8b78f9912230e0a212d3ff7f01db8f42

  • SHA1

    efcde05431279abfe282e869ccfa53b1f6d32688

  • SHA256

    6e06b764495fc246c57c604363ccc21db72c8a4776660b852ee000cbe6a488a4

  • SHA512

    d19c1f572e47d84d6d9b439ec4d29197324d603c96825a87a2d28f07da6fbf842a0e05766b3e37e0ef34dec19fd7bc89651788bc43efae29cfd7750e603da8fe

  • SSDEEP

    12288:PmHnAOmmeOwjvpFVHfYtdsvaTjwrej1I9Lu:PmHnAOogAvdeWBu

  Score

  10^/10

  xloaderd5ttdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/nbcnvvhhow.dll

  • Size

    20KB

  • MD5

    967aaecddf0e31f0de8582942a26d086

  • SHA1

    1ca5be0f614bb4db3608dfc0f549e5cf83442164

  • SHA256

    de93a37794cf18a166c2a36646997ab128da7cd6b5b540f6f596de537bcde8ef

  • SHA512

    bfd279d0ceea9f5e70466977989d89cf2885eca8713c63885ad2cac32e3030eb87a3237c71191448f6c026222a3bfb61a47944b2fd548f393bcc1a4313191a66

  • SSDEEP

    384:QAMYwn4GqWlh1i9E8LB2T35YjzYDYp0fRBtsoudoq0rH+eNyp:QArwnskhU6tTuYkpoudoPty

  Score

  10^/10

  xloaderd5ttdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4