Extracted

• • Target

    JaffaCakes118_371c76d36256463a54d34e12d6741720

  • Size

    251KB

  • MD5

    371c76d36256463a54d34e12d6741720

  • SHA1

    41843093a5b3a7f5712abd30937004b203851252

  • SHA256

    4de35ea5d1f54708e27e4806246a6c9d9b2217cfef24c7b2321a8f6026c5d98c

  • SHA512

    f2e87fb4628a8b413ced0d92bcedafc4667e8655ac2c13fa15b7f806ddd19daec919003da80f4157f83e5a24b24a4ccac98c2dfd351227b6a549443c8e7c5759

  • SSDEEP

    6144:wBlL/cR8tpViH8hHseEJ1eG6/211J5nQEnURg0HZoAA:CeRSpNhH1EGZc5tURggZoAA

  Score

  10^/10

  xloaderm5cwdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/ztqv.dll

  • Size

    32KB

  • MD5

    97d84d39bb68b5a29e976b40d7d0a00c

  • SHA1

    cf4c09487fffb9ace9ab6b82f33da0d5a851ef1c

  • SHA256

    5b29c5ee49d9cdde15d88a9e4f8f6b4bba9e2dc4ec65c02d734726fe0f2952c8

  • SHA512

    aab5b8831538f96c00e77f16349065bfaa93e7b25206a6d5fe0871f518f38ae31437f2f9f93f36f488e1869eaf97dd4697a282d726ce9a292cf4276242733546

  • SSDEEP

    384:0ajTrn6tBFCu8OW5x8Yz7x4qTNe730g3ErkdjrNRKJNPqDuqYASKmIWoIVgQrz/L:0ajfEoVOUN2x3ErIrCNPmuVhIW9zf/L

  Score

  10^/10

  xloaderm5cwdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4