Extracted

• • Target

    b7cf8d9d8db4c5eaf796d35251bfc2b24f34c2c77d2ca82a1ebf470323c0894f

  • Size

    292KB

  • MD5

    be6ece1b6510c986870d8ceabb87988b

  • SHA1

    63795ce8b9c7fd5ec3374e3e012b3898a8695f53

  • SHA256

    b7cf8d9d8db4c5eaf796d35251bfc2b24f34c2c77d2ca82a1ebf470323c0894f

  • SHA512

    c7296be4cf5c14ada776312ceeedd29b52b6e4e228e6f1453e5485571099f6c517e90c6f33b88835b51130056bca6d2401d1bd6aed7e0b9d590d3b7b2c60a334

  • SSDEEP

    6144:oweQYmMhY6ydhGhzXu2UDOyDSWwDrW12P4v2B/Bd66R6DWV:6QYNILOzWwDrWsg2JBxR6DWV

  Score

  10^/10

  xloaderp2a5discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    cznfe.exe

  • Size

    120KB

  • MD5

    3464aade4cb916d733fdd606c3d70165

  • SHA1

    0c47d2c2d6a12cb78275f0d9b3190b1aad04805b

  • SHA256

    a1b617196797fb690647c6f4f0329be8087bdaf222bdbe8bcd762ebb619e5ad2

  • SHA512

    a4c01810521414aa8ca7757fae35f8710f37d109360d240483063dd22db3e94e32cf9819022e4e1d7b3ee7845fa635bd9417645beb99b400bf3f8e93cafbfbeb

  • SSDEEP

    1536:IfWkvZXO/xInkKwbKL8z7ekV0uBNb9QXCLo1QJ//SivVjSoFiALGbJMc84sWjcd1:2vZXkQ5GoI9yco1Qp/7eanNgI

  Score

  3^/10

  discovery
  behavioral3behavioral4