Extracted

• • Target

    9900f17982dbcce4d71a73e9597eef72e047bc31e0fc0b6e1f8a8bb6b31956ae

  • Size

    378KB

  • MD5

    5cd3ecc6fce1412c76dac663c0bcf8d0

  • SHA1

    11b58a9f67d44e8f6410188242aa8a9be5a0890c

  • SHA256

    9900f17982dbcce4d71a73e9597eef72e047bc31e0fc0b6e1f8a8bb6b31956ae

  • SHA512

    0c1c822652f82178864df841c4e0dc946c4148a22d00262fe39f64459efd41b5d17987c86d0ac91830a246e89c1bcd39ec5c253bcfb027af3e91551045326463

  • SSDEEP

    6144:68LxBbme9sRA4OyhLgHPvBsR/SU2TPs5t775BYBqbdzXYnat:MP28hs3oGPgVu8bF+U

  Score

  10^/10

  xloaderwtcvdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/jljzzkpi.dll

  • Size

    16KB

  • MD5

    2e33ff375eac30535f98a7c72b438c60

  • SHA1

    180f41f2c881accf775ec93bfd752be043d1b391

  • SHA256

    d1f5b895b161b27f1451c7dcfd4e73cd76e738e6cfd944692defdd95b57a2ae3

  • SHA512

    d18492db4786c8df36f09fa474a8d4825d0f192ce05bb36339db6ba9c30df18a1896f348b5df4bcc427e5870e65ed4551ca9032867c6a7966c98ce8874e3d356

  • SSDEEP

    384:MKrMSejPKmlxZZvDtracQBiXZW97WEbuID:MkMdz/vDteBBiX8kSu

  Score

  10^/10

  xloaderwtcvdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4