Extracted

• • Target

    PO3118.exe

  • Size

    393KB

  • MD5

    7472bc65871e7bef7264c09fcc028e4f

  • SHA1

    c0420262972a81c2332f83a0736f48ce500dc2b6

  • SHA256

    d6ddafd9aa4fbe03e73aa4f1b4854d83503eb4fe9b91dd6f3ac44a030847c2d7

  • SHA512

    bd4c3397af0c66626ab5c35c95bb5dd74134ef348375cd338a1013c8b1c9ccf8fe936f23874153cb32145c55c01ac660d0db293e0d7451eacc907540eb9accdf

  • SSDEEP

    6144:id/ztr1lc8xB6SSQ8mst8hTM+713eGlaUlBfqcOvCom2K9ItlkEvmrVuy5A:WvlcWBe/WRiJHmYtlPaVuyC

  Score

  10^/10

  xloaderpnqrdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/cvve2p5h0gqmdd.dll

  • Size

    4KB

  • MD5

    7dca75191f506b4a9dac4683211aafc0

  • SHA1

    c31b50e4d74aae90730d308d70e166c6c031ec54

  • SHA256

    28b2482383978cb373546a80213c9c6d03e4af09f2399e5b8d115811f822200e

  • SHA512

    382d43c225cc815a796be1a66f111dd396ce8921fb424d92987cd3055850272f597d5eee4d84ae1b888577833e134b296934a37a26c882d04f520462d99aaa74

  • SSDEEP

    48:vpgHXJOhn3sj3EprS5qD3T3/OsV2OLuZKQi3eYmRbS:BsM3sj3ArS5qDjvV2wuZdi3eVR

  Score

  10^/10

  xloaderpnqrdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4