Extracted

• • Target

    JaffaCakes118_ef243115db5fd87673b93a350bfc68f4

  • Size

    249KB

  • MD5

    ef243115db5fd87673b93a350bfc68f4

  • SHA1

    533fcc44583bb2f952cd76e7eeac1cab65de915f

  • SHA256

    408d42bbe82ea5d8abee447060a40ff8289f4c3317022d6c0a1081c37d25b164

  • SHA512

    90d5a174fabc57e74e78ec36c9ffd46c2db9ede8018ef29238017e5d5c87ae81813f68a42deb8dce891b25320f143bb47b01cefbc55f529499337a430de06f17

  • SSDEEP

    6144:wBlL/cfBEIt4tl9u58/YK3zX27E1NQLv4gxrL6QE1/ytmnv7YC:CefiPuOgKjXVNsQgxrL9E19nv7X

  Score

  10^/10

  xloaderga6bdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/mtpoerkl.dll

  • Size

    20KB

  • MD5

    adc8b564ab49cf22c95760ca373e51ce

  • SHA1

    ce0bb7c028a41868e1c2003710c386d84d1b0563

  • SHA256

    5e074e10a889e3790c6fe2bd7131f3e990e234dd64e30feb812ef32441351e48

  • SHA512

    f0f4251868231f9f693be855410cf559ea5b5f687c4d9f6651fbd39e01690de6e57db9ab6023e53d909efc3154ead6a7daefe8a65f3e39aa02b991cf6c5feef3

  • SSDEEP

    192:9dBwHlinVnbk4ia/6n3lfNIgJ2PIXyY8gu0tR0buCGfibI6sKOwS5iMrOVI2qFOE:P+FiVbkftNIgoU8oCioKKOw1PDqFjh

  Score

  10^/10

  xloaderga6bdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4