Extracted

• • Target

    8df2d74b5e18e72df64a8c00c3029ab3dc4cdd34cc30911be682316f9028c280

  • Size

    338KB

  • MD5

    bb84bb36af9481380cf2074b311b51c6

  • SHA1

    bd7789ada08fd16894bcf0d269991c7aa5e79c10

  • SHA256

    8df2d74b5e18e72df64a8c00c3029ab3dc4cdd34cc30911be682316f9028c280

  • SHA512

    828b2287699abf1768623be0ea68c2f38e74fa5b94a125bfd78aaf345c87e14460828be6f51899fd091da0105d37d99fc134a55c5825d16f2b761ca86e9daae8

  • SSDEEP

    6144:QGi9fvS1tIr8IiWYCBFk8giJxzC/eyu8o+87eUb5/1l4b3Oj:oqtIr5vRgibz/ycfb5Ub3g

  Score

  10^/10

  xloaderseqadiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/spgmjdph.dll

  • Size

    93KB

  • MD5

    0fbc559ab75e9cd8326de1b0aa075a8f

  • SHA1

    ea1c07acf1913c487c18060380a71bfe18b72791

  • SHA256

    bdf272998ebda2e91775e6a463ff01cfcf1cdbdbec3309bb61caaf1b5d28eec4

  • SHA512

    72b83b58dc1ec3051557431b50b146784f43fcdb0d5c9f6bef7c9876d8455908f3c486be561567e71b2036fb13ad6739f713d4205b079a6c379b4306154ed1f6

  • SSDEEP

    1536:j5ERZT7DoOkA0L0zM5oDB6HKbWyhe2FBbUfs9Cg5+l1OB:j5ERZTPoOkA0avBge55+l

  Score

  10^/10

  xloaderseqadiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4