Extracted

• • Target

    8cd0e616d6bdbf46e397e681954f326dab266d99f7197b5d4800460d44c3fe06

  • Size

    243KB

  • MD5

    4bf4450020724b27517cddead279c4ed

  • SHA1

    4ced998f7bc61731e9278a40465ca56da64fbcc5

  • SHA256

    8cd0e616d6bdbf46e397e681954f326dab266d99f7197b5d4800460d44c3fe06

  • SHA512

    3a816c892d8a3d43a573e377081bec8e12ef7e2a3ba0a63302be6da15d583cbfeb649723b44eeb944d9245850c465cd1cec884b91d44573c9743cd9cd4186796

  • SSDEEP

    3072:rS17XJiDxmJJ9VTgr23+Jhif76pfXRu4iDKEKD3b+lNx52hLHAnwCFcj7USifb4u:rGiPqdOd04l4lZ2lHxj7ZtJmIyO0Mmie

  Score

  10^/10

  xloadernv0adiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    wyzjr.exe

  • Size

    4KB

  • MD5

    1a5ec202f8169810c65c8a217e04652c

  • SHA1

    8f3515de3ffbd19e5410632243cdd2c7111346df

  • SHA256

    d8e511d26414c679bb7386e511a2847f627a431d33cd91f6f7860fc7d6cda704

  • SHA512

    98a1172857e64e967c396492baad7bd65b7175c7631e854b756c2a7fe046406a700d91f0b6075e95c74ddaa76631bc2436797b16dd1f637a0279b13ef1187061

  Score

  3^/10

  discovery
  behavioral3behavioral4