Extracted

• • Target
    PO4308.exe
  • Size 562KB
  • SHA256 be104552eacbe49cf13a5097c5856782c1b07531bd2eb2e4db5bcef7edc14b6a
  • MD5 31af998161ba38d78141852121a04f62
  • SHA1 80b1a3ff2add16c96d873b337562d3d2f0ce5dbc
  • SHA512 97c189011a409206b2f61cfa6fe72888ba0efefc7e8216cbda1566aa73a39f25c14555a629afc561845d9319ace4deae22a58e4e2b41ee6e47c3013504bc83ea
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2