Extracted

• • Target

    JaffaCakes118_36e60a2ecd13869a78ad7bc9312681d0

  • Size

    255KB

  • MD5

    36e60a2ecd13869a78ad7bc9312681d0

  • SHA1

    8ef2422980fe2641a0d101fa1649fc24c43c2e97

  • SHA256

    b6d84072166800bd1d35ca9265107d6f26496c7375411ca818046c5a28dee9d9

  • SHA512

    bcdfe6f2b4db1dedac564e4e50de65ef1387e9613a063bc118b9da3f66c08587aebd90923a6706ca22ddd334e7796d7c214b3636ce49c5acf0b533fd2d834a36

  • SSDEEP

    6144:wBlL/c0Wy5g5EupgNkaSYC7hjbUoVhmVuvqQLWT8ZEkzPe7SsGQNN5X:CegGMpSy+HLzzQ5X

  Score

  10^/10

  xloadermxnudiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/dzksq.dll

  • Size

    39KB

  • MD5

    52a665d244ddb5192b3494f4ca1bd978

  • SHA1

    07bd3f140917cd3992e9b9ffc120c84af834472d

  • SHA256

    63466cfda81d5da190e8d3198ccff849e7c651f472efd58d277add978a50f131

  • SHA512

    c892de4792dd99d8d9eb3da0e42d80132bb613062cec56faa0429019ca3e8e32804e2d065f72cbc8c960000013e113753bcd15b836e4d19f147f37f2f12e5648

  • SSDEEP

    384:+2dM1L9bVtSJ9X4qFTrtR1836QFlqIknaqRCz+7lFYbJ113yMfAuLF+8ay:+LFVtSJVFTJ7arFlRkBFY710uLF+8b

  Score

  10^/10

  xloadermxnudiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4