Extracted

• • Target

    PO1922.exe

  • Size

    436KB

  • MD5

    4206075224453d62fdff5aa5c32e392b

  • SHA1

    5d862e2e94f2d83d1594d21fd4f73d96a192a2f0

  • SHA256

    c804865a31c4ece9c6dbf12a13593c3402f04618477746eff72709c5dc5d3ebf

  • SHA512

    7c048a79159f82fe3295a92f471dd8c8f01f8ea099bf1c8f53d0335f150579fb102baeb0df9c4c96a15af57f40cc11406a47d14de3975e3a1be605c572889062

  • SSDEEP

    6144:fwtwbmreTCxk0rd6Nz5iKk2CGE+qMew4cfhF+jhEKdwL4ZfRzvULe:gYmi2dvN2CGE+AMFkh56L4ZSe

  Score

  10^/10

  xloaderssacdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/hahe.dll

  • Size

    19KB

  • MD5

    c2011862c7102ab56ad2b1d8bd68d39b

  • SHA1

    92bd5b2ed09c6c291732a5de851863410e97dd7d

  • SHA256

    441abd6663c6823e8ac2c1facfa6bd147e28504c43dee969376ec6cfceb898d3

  • SHA512

    c9971837b6b420ae4d72f265b118cce6667116d3d00c5731856708ae8b7c93070fafd34a62bcef0890014cefd115a5ef6d92f380735fac415b1a129c256187fd

  • SSDEEP

    384:7XKkht2za/ke5vkgNEIp5xTkEb0sckt64w1Ka9eC8ll:7XK0t2L2xAEooBBJr

  Score

  10^/10

  xloaderssacdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4