Extracted

• • Target

    5f8d69976e4d3c9b6508cd376dcab4971a605d8d1122952ad604f7b48d2ef1e1

  • Size

    315KB

  • MD5

    d51f1d0cfd3d340217a10563e26b874b

  • SHA1

    7a0208d13ecf6943af12a9f49b1f66b10d3ebeda

  • SHA256

    5f8d69976e4d3c9b6508cd376dcab4971a605d8d1122952ad604f7b48d2ef1e1

  • SHA512

    53a440e7b2d450c15fc340a79f586c7d6021ddd3adffe8af9ec9cd54b301749abfd10184d784cd2dea6a0595576cbe7526d4c7de838f2c183c297e90285e7f77

  • SSDEEP

    6144:TxDZ+uY3Vi2Ad8nC3aXrPvT0b663EFC7TY6aU3DaQuwgTNN1rxf:z/acTdf3E5dUvYjU3uLw+rN

  Score

  10^/10

  xloaderfsggdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    kyggpnadk.exe

  • Size

    168KB

  • MD5

    5258ea17d00705e2accee3c63e21d7ab

  • SHA1

    ae2d56d597d50bda9dadca39cd71b8488a28682c

  • SHA256

    8e9b30213dcab171d3e65d0da99e4a847da5cba6fc47f3641d90e8d6e70637b6

  • SHA512

    30c68b68b4caa22747bc8312fad4089d5d45e10565f03718d8ce4fdf9d5b53f8e60a9d5ca73fec521437ccf63eb902cc9a5534cafe1ffff7658810e438747e8e

  • SSDEEP

    3072:fc4Horf5X/n8eXZHTFGAfU7VKXHGHggYRdDUbfZm:f3y1/n8YpDCVKXHGAh

  Score

  3^/10

  discovery
  behavioral3behavioral4