Extracted

• • Target

    1741b050332dd1a6189cb5f6367a198d4528edafff28b1b71930ec2acb385830.exe

  • Size

    253KB

  • MD5

    5916d20b998ef8ef31a2cbf939448434

  • SHA1

    9a763e6a85218e88fbbd1f6b3c01e794ba531e87

  • SHA256

    1741b050332dd1a6189cb5f6367a198d4528edafff28b1b71930ec2acb385830

  • SHA512

    1f12db81914f5b5013897f0047821e3ea05b06b30912dc370b2826c8baa217e00d9d7a8a7a7febb35ffb29bdc70f6f70208f5bc2993071ff0a06a0ec750eaf1b

  • SSDEEP

    6144:wBlL/chMcQPqiO39fzYQZAuA+7Fzn611zg46LxEggZ:CehMcQStt0cAu57pw1zlYxEPZ

  Score

  10^/10

  xloaderd6pudiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/zntsolrgxs.dll

  • Size

    38KB

  • MD5

    fe76b0ef249aebd98f82d6437721c047

  • SHA1

    b1d40595e05da9c6f8627885b36177d4ecd54f21

  • SHA256

    39724fa50de7a8937dec84a3f00fe23c9dea895d312bdce8133db18f15ee1a81

  • SHA512

    abff3bc26f23c3c864bca8bb4ef1191278bb88bf5d604db949a822fc98525bcecdc21acceffbca1aae5557c8a13e9e15092837bc1c16b3ec2d03c6b3fc8fd725

  • SSDEEP

    384:429M1kCo19eJhv2BqFKrtR1836QF0q5knzxRCT+7BoY3Vq5b1520IVXOFCfl:4rQ19eJhDFKJ7arF0gkpoY3w5baVMA

  Score

  10^/10

  xloaderd6pudiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4