Extracted

• • Target

    doc_391200004532000450.scr

  • Size

    899KB

  • MD5

    1e1f169ac3fc87ad55252f38cad083bb

  • SHA1

    ec778acec7bfe578f6d13556765e5ed5ba0a405b

  • SHA256

    6c6dd45a923d7eb6fa1f114a5a4c20fab27bc03e44a5c8cb8627d43da93dfe48

  • SHA512

    edad0f0ec3c9b0daebbd7ab17ab182cdeabb3fad0ba0d08a2191f1007f41b8cf995ed9082fa3439857065900a1ed3b5c73091113aa8bb6dc3db6813ebf24ee35

  Score

  10^/10

  xloaderloaderpersistencerat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2