Extracted

• • Target

    RFQ-2203IQ22.exe

  • Size

    363KB

  • MD5

    497c61e3c3b524f3f5e21133e25e9fed

  • SHA1

    3ae28a52da98599f857c6086bd650ddb7a08884b

  • SHA256

    e8a006ff04f0284cdd1008d687dc62231e78886c017904c462c0b18d9b938a8a

  • SHA512

    4fccfe219f77d9cb9da4c017fb28e33ba9fad4f7e7202525ef7a0d36e39b2c51b70d5d61e4ff011abee75f39cb1910cd5580274aa796991c8366ee3cb196ab3a

  • SSDEEP

    6144:TGi7FnvhydhcoKQB9IkZFPVOcVKmPo1irNYMr08C2YuDPwHEzzRof28Jt:1w95FdOEoKQ8C2YuDPwMzefRf

  Score

  10^/10

  xloaderiedidiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    dbhvn.exe

  • Size

    107KB

  • MD5

    2c3eb1912198569cf1680077ac995221

  • SHA1

    c69948d7e3d380b1b8d29df7501eadc0fea857ec

  • SHA256

    e1b09d71f05cf589e41f3701142b3fd917508e3b5f43eaa810bcaeab74f18165

  • SHA512

    9553c96268cffb7638ff1e2df116ddb039654fc221328a6fa5673d1b502cfaca6d1762a6e3a537d530eec6c66004058520de6592aa6492e80f7faef7f73e49bd

  • SSDEEP

    3072:/PyndOgky6ADbfLwjQRnOA9QNvRWK5Ow3S9lTypMu:indO75ADLMkRHOWKcwNpMu

  Score

  3^/10

  discovery
  behavioral3behavioral4