Extracted

• • Target

    EPDA MV.Sweet Lady.lll_pdf.exe

  • Size

    205KB

  • MD5

    a89f3213f565db4ec7d6daa25ccf5bb5

  • SHA1

    8764eccfa6c1689d8cfe90a652becce02ad94692

  • SHA256

    0bc4d1e45ab93d84a42b64fc2d0514440e13dc7afbed98e51e38f1d5d5229844

  • SHA512

    405cc3880b2eafc91f5cf06175b21de2f4d9b534db7dcc7f42325891d1573cde6b80646e72ddcbd7366610a5cb1bc2000f3de524b667310b7fb03d42167f29dd

  • SSDEEP

    6144:r9X0GfXLULFwWCnObVvM7FroK5W9JuqJ4d:F0qX45sObyloK5WXTOd

  Score

  10^/10

  xloaderoeandiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    3bp6xookqs5b.dll

  • Size

    11KB

  • MD5

    ee224cf89c92d8b8d08cbd9dc183e6a7

  • SHA1

    8ab4416951d706730fdcf9422ac39a7308bd3443

  • SHA256

    bd5ba137ea2f0162b1baaa6483f5f8d56a3327818c0c96a2b04842638625a8f3

  • SHA512

    261a568b8b3ee4a3b8fef2dd99889495ef91c05a1e593c23d36ebb495872e6623f8be20630a52126dbde8720aabd24f047b3cc654f744afe9310a4da01702005

  • SSDEEP

    96:P+TPj0ToB99zhvmNHcZSEdShtRrs2fagG6/L/fPPmNH/u64ja5I3tI+gjG3mRtxx:uPS+9zhO1ChYhHrHaov+pn4mOtIq4

  Score

  3^/10

  discovery
  behavioral3behavioral4

• • Target

    c0qit2o.exe

  • Size

    3KB

  • MD5

    2632c0058c899f8a94077b5abab7cc96

  • SHA1

    2b2e620c7964d27828f903ebe4cf9359390a5f06

  • SHA256

    10241509299a29e8bd8c016b7ede6703a00915f65ae5165268f58bae93cdf37e

  • SHA512

    a662a4ff0bfe8fafd3216ec98930a9805b8771d05fb803d3d9a9a99ce04e145ae60bcc4ed63574c712994e6aec90f03a1900a64e6a0021d010b0f016913d801e

  Score

  3^/10

  discovery
  behavioral5behavioral6