Extracted

• • Target

    SKM_4050210326102400 jpg.scr

  • Size

    214KB

  • MD5

    5dc5f2545bfd91c046ea5ea030147c93

  • SHA1

    118ea38bcfdd48e38acd33e68f536012f2a9e71e

  • SHA256

    257432b5ffbd5ae253f6be351f71f968d407f15e7f5ea78d7b613c7d663eba9c

  • SHA512

    3da13538b130761c21847d5df144aafa83fd1e0ac9f9957421ea81d99092579fa1e73dcca6305edc5f220f38de18b747af6aaa24f1d9863da89cbfae58c89402

  • SSDEEP

    6144:cQqeRseZ3O7WdUH2RIe5vt4x3oDmeVqRIxXP4Wyt:PRsepO7SC2SeNmloDmROxg7

  Score

  10^/10

  xloadernvj9discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    fccff8cb7a1067e23fd2e2b63971a8e1

  • SHA1

    30e2a9e137c1223a78a0f7b0bf96a1c361976d91

  • SHA256

    6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

  • SHA512

    f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

  • SSDEEP

    192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4

  Score

  3^/10

  discovery
  behavioral3behavioral4