Extracted

• • Target

    Purchase order O4500016955EqgcN9Xz7YZKqZ2.bin

  • Size

    1.2MB

  • MD5

    1e956cce584ed3910b0914ed03c5b396

  • SHA1

    c8e5c8f09696b8d5c81ed979a5eba7066eba5305

  • SHA256

    0c79a0b34b24ef2f69bb07586863afa5d3631398f79b895390ec2beddaa4fb78

  • SHA512

    47196bae5faebcb994d690651d7ce91ae35482f24c42ebd290b681dd5f60dda421368c20bd849d81d5f8c6e882ef084d3ed5c3ed118d1f7133a23e3cd7e66b3f

  • SSDEEP

    24576:J6QP6K2CngiZucOaCrYz4jEmW/g+xRri3Md+clMr+b1E43:tPb2CgcyrKmW/PHi3Hrqv

  Score

  10^/10

  discoveryxloadereaoloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2