Extracted

• • Target
    gon.exe
  • Size 721KB
  • SHA256 e812adcd8f8470a1be64d92dafaebf717db1c45d58fe04a9160d88a468cf7e3c
  • MD5 cf80558eb44d749850aad70fd8237f99
  • SHA1 1c15af77ead16dbc2d7c3c1da7f189043532acd0
  • SHA512 8fec85df4dc40220982deceb444f16aa2b81054bc458ed6a68105d7953f5eb11357e299ec6e1a60309fafe260cf299ab99700725193cba7b20c64ba09c531128
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloader8gceloaderpersistencerat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2