Extracted

• • Target

    JaffaCakes118_a26c06af19d765ddcb32a48cd6acb1eb

  • Size

    376KB

  • MD5

    a26c06af19d765ddcb32a48cd6acb1eb

  • SHA1

    152dcab66baef093434bf69a0c3f9e78f7bbeb90

  • SHA256

    35204f1850b1439ef9a8fd958d6c3045edae69378aa3593021795d0600fc5a01

  • SHA512

    98945dbca44f5620c66efb7fc323e796e04040d0d19a1e5514843daa5c3ee6696739e9e19c6b38ff78ce3328db45d073cab471fabd591e4b962248b4d24422fb

  • SSDEEP

    6144:qBlL/k6xymrfKeNn6/13qb6RVCz9j3wJPJFpSZX8F/wnq5onDZiD7ptk2:QhymjKetV+RWTiJvKnq5KDZiD7pX

  Score

  10^/10

  xloaderb65idiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/gjspvjmvb.dll

  • Size

    21KB

  • MD5

    cb5ae97fd494cd241495179668d3a3d2

  • SHA1

    33e6282a11c9140860710cd4a251e428e5cb75b8

  • SHA256

    2e31c7a695a70e216180fefa04ff81c8ad783b72b8d5fe40f506e00ada784f6f

  • SHA512

    83d265679fcb712cb8810d9b24a68c2d952cdb00656464b3c52a34a9bac48a62d2ed26d82ff0837946876bc1d992796376703a394da4c451cae671a043f32f44

  • SSDEEP

    384:aSpqwtpSNch8eco6p87VVV++jtFQmsDyPVyQYEJILzZcR:aSpptpVG8vVljI5DYiEJILzZk

  Score

  10^/10

  xloaderb65idiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4