Extracted

• • Target
    RE Purchase Order.exe
  • Size 217KB
  • SHA256 4b5ebfee6d9719c8f11ab46444ba5c2c803acacb095ac868eaee346924976d77
  • MD5 7a07e240643138074d0c7a0808a28ddf
  • SHA1 997229ecdcc783114ee789b422401a0030967b8e
  • SHA512 abf89c783e39437f9d8ece65980d2da3eff04c5a25bb8d609f720e355f70ae2dc0db6dfb10fb4a79928a1d02d76e534398f9ccc940c9ef36094d27a0a70b35c6
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2