Extracted

Extracted

• • Target

    Descargas/2dc07e970dd5581d1bd22d69e454dceda70d8f87cc84757f86c094b2fdb7f985

  • Size

    814KB

  • MD5

    8b2c2a4e77c6b9eb8d65105014f634fe

  • SHA1

    12b265a19183685c13ebff8aeb0da7f891202b11

  • SHA256

    2dc07e970dd5581d1bd22d69e454dceda70d8f87cc84757f86c094b2fdb7f985

  • SHA512

    0147547c61382e1c0e0035ec962072b0372fc66e8437ebc4e8fa6a74db68e3446f2b7e98ac2431504dfd4bb4e6b79e0d04f8210372b7f44fc4c534b015b789b2

  • SSDEEP

    24576:kAl8ANFu+dldXQka7daosVjJP1AyZqKjlCqfQLEjdk45D:lNFu+dldXQka7daosVtdBZ1lXQLEjSg

  Score

  10^/10

  xloaderm8esdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    Descargas/bbcc980fba33eda0491b1f7c1c1f6f2cd53a1c26ce2cf2154473263a1935b243

  • Size

    1.0MB

  • MD5

    fc904c1d19f4862ef2939e242c1fedb6

  • SHA1

    4d05a65f64f9c4c56b21847b208c797d5366991b

  • SHA256

    bbcc980fba33eda0491b1f7c1c1f6f2cd53a1c26ce2cf2154473263a1935b243

  • SHA512

    0fa97543b70e1d4c38f72cfff0cef0cdf2f61649ae17b9906ac522cdb6933e99b223d47fc0141b1dce1cb7a85bc089d8f5733f992ddfa7842b3647b3c532220e

  • SSDEEP

    12288:8BhXITnk6arPHN7uWjqsNTQ+Fq2k4G0g9v8Djz26Dq/miHyuGFAY8CaODXUsvMXC:88Tnk6arW+k288Dja68xLG2XODXHMXc

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Suspicious use of SetThreadContext

  behavioral3behavioral4