Extracted

• • Target

    79e8144ee4e2e97695849928e162288fc282de48ff4caea48314f9cb56477917

  • Size

    313KB

  • MD5

    da75710d466d2544bc8f4442b1ce57eb

  • SHA1

    8356ff061e4864bfe114fb9e65bed20c267c78e3

  • SHA256

    79e8144ee4e2e97695849928e162288fc282de48ff4caea48314f9cb56477917

  • SHA512

    6d5c8f28f60bd494cade7bf4324c3309ac29a421202dae3494b8118ade429560e4062a2c83bacbfea46c63fe173bc04ffc299b8dcd2f611d67c45e7cf2c22695

  • SSDEEP

    6144:TxD3m22lVTV6BSLia0bfMUB8uEqLjLQ7LYAbesH/pAK+eRBYBD:Vm246BSLTkfN8ubLj4Uy/pAKaD

  Score

  10^/10

  xloaderciazdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    yjpsyjwo.exe

  • Size

    168KB

  • MD5

    c55e114aae523179f507d32858962fe4

  • SHA1

    3a35f75de10123d4b438d7be88c6bae7087a9a74

  • SHA256

    445868ae39772e2a65c0e927d6a98d240d93c8515d57837b95c17304ea0dd693

  • SHA512

    3900a645770ed43ab18de621f85f83588efe9fafee732277ee26e361dc417560a0aacea392d7975634e16f250734dea1f15c8aa26fb8b80c31bec1833da9044c

  • SSDEEP

    3072:Hc4Horf5X/n8eXZHTFGAfU7VKXHGHggY/dFUhqZJ:H3y1/n8YpDCVKXHGAr

  Score

  3^/10

  discovery
  behavioral3behavioral4