Extracted

• • Target

    DocNo2300058329.doc__.rtf

  • Size

    316KB

  • MD5

    5e37b9c3ab14d8c2349506fa6be2de0d

  • SHA1

    1e5777efbbe88c9f92ec0438eb07d9b7c92ea43d

  • SHA256

    1256f793afb38cb63438acdbb6e1e3646eb66d4ecd1c4fe79178702e43311c94

  • SHA512

    2eb029a1e719a5312084d0ead75af3276a9bab55a112f71df820fd4f681cdfda7eeabdc8ca1cd124e7c5381b5104bf712117fcf1ca6f4dacc6379970241cddca

  Score

  10^/10

  xloaderloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2