Extracted

• • Target

    JaffaCakes118_2d0ac0a8f2d2aea1f05429585c1bdc4c

  • Size

    249KB

  • MD5

    2d0ac0a8f2d2aea1f05429585c1bdc4c

  • SHA1

    3657594459b01c0c918e0deeaf3ad7f05a4efd90

  • SHA256

    f1d7ead1ca0f3e39c12bf5b67bb35cfc745acf0f587c2d6ce45eb2904f44aaa7

  • SHA512

    863b35e33b0b09aece9268c83ca3411180c23463a01e6b93744b978199c7fc386ecaddf0776588be59bcf41b46f4584e7405a17f1ee3cc64df602655036f92e7

  • SSDEEP

    6144:wBlL/cY0AMznI2l481Mzgem84ITAI43r3i0HkAEQhYW:CeU2lv1MMDZi0EJeYW

  Score

  10^/10

  xloaderu5ehdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/hkdklixzga.dll

  • Size

    19KB

  • MD5

    fe53df25d11886ebd5c24164328ca8bf

  • SHA1

    3d051e82d0bd8bbd4c5647ab11a36e8fe0407631

  • SHA256

    d3827d83d541e98cff0bb89a27c2db75e59b62ed57a934cc8c9e6a9623864716

  • SHA512

    578a786ea59572ae33b245314493bfda501eadde6bfcad2e20fd45e39e7d2e6e237403ed912f38aebd3fa79c582f27e7846f0896e22e01d1e276abcb8b32eecc

  • SSDEEP

    192:JPEvK1NldFntndU2KQb3s63lfap1J24HrrdbY2T2/pa7Na7x36Af6TdzFIiqsXQ/:xEC1rdFtdUsnap1o4HOXpa7hAClH4f

  Score

  10^/10

  xloaderu5ehdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4