Extracted

• • Target

    1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe

  • Size

    251KB

  • MD5

    2627ba100abc4933106893191384a31d

  • SHA1

    a5e77daa3cd30c6ed8106380d408534aac4e6eeb

  • SHA256

    1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac

  • SHA512

    3769f5645a0e310865fea09e3ca027aebb1b3efde328157b73c61187b3158301e102e5d56a17140fb0d36533c89bede93f124bc657dff9237b6112b2d8c935f7

  • SSDEEP

    6144:wBlL/cR8tpViH8hHseEJ1eG6/211J5nQEnURg0HZoAg:CeRSpNhH1EGZc5tURggZoAg

  Score

  10^/10

  xloaderm5cwdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/ztqv.dll

  • Size

    32KB

  • MD5

    97d84d39bb68b5a29e976b40d7d0a00c

  • SHA1

    cf4c09487fffb9ace9ab6b82f33da0d5a851ef1c

  • SHA256

    5b29c5ee49d9cdde15d88a9e4f8f6b4bba9e2dc4ec65c02d734726fe0f2952c8

  • SHA512

    aab5b8831538f96c00e77f16349065bfaa93e7b25206a6d5fe0871f518f38ae31437f2f9f93f36f488e1869eaf97dd4697a282d726ce9a292cf4276242733546

  • SSDEEP

    384:0ajTrn6tBFCu8OW5x8Yz7x4qTNe730g3ErkdjrNRKJNPqDuqYASKmIWoIVgQrz/L:0ajfEoVOUN2x3ErIrCNPmuVhIW9zf/L

  Score

  10^/10

  xloaderm5cwdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4