Extracted

• • Target

    order payment.exe

  • Size

    291KB

  • MD5

    ec2853c83cff7b763bb603a2754749f1

  • SHA1

    0d7e640764aea9b1a8585ac57edf8e2061cd5c61

  • SHA256

    9cb67c087ee707c5878f773e00cc4d55ad3b9fa3092b9ea9614647a06a9c9003

  • SHA512

    e8f6521f398c1670f3efb5b34b52e58eb8f960a8496e81d5ea180ff763581fa7802ca1352a6ec5733d449f68e0a1918c8744fd8b824e9b15ad10086330e8ec5c

  • SSDEEP

    6144:owkx9R0tcuke6acPbZv8f3tdSUmuzpJ40N/btqbJZCZquFHyqWUG:m9R1GuPN8/VdpJD5eZATHyMG

  Score

  10^/10

  xloadervoa9discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    hgdwc.exe

  • Size

    120KB

  • MD5

    b1179c8714525c79f49b3e1cdbb37339

  • SHA1

    7cae6fbe83da4a0a0cd4f090e731d50c7622aa05

  • SHA256

    dbff6c480833bf385c392057177822a2b6c7cc988ec6305c021aacf3e89c0f94

  • SHA512

    e23b43787e81f758e2758febe49c89680dbda8373acf3301b0092339f537c734425724bf13c7f210e8b76541cee68a544f8f8bc8682d24e138fd59815d0774a1

  • SSDEEP

    1536:PLraTSjiYFwlvwVC1TsJ66zafChiC+JqeeyEez1wsJG+c8o4D/0sWjcdaGWd:PJjFwlvweI8kaZ94eeU1oy7aG6

  Score

  3^/10

  discovery
  behavioral3behavioral4