Extracted

• • Target
    Inv.Copy-Amended.exe
  • Size 564KB
  • SHA256 9d404915e1094a0bc1db1256b1c39c2d76589fec00700e2a9874f2822a429ba8
  • MD5 8a70ab793762cc9ea4bdf8d8a7b3f729
  • SHA1 711a51d62039a86bc85820727d36e913722051ab
  • SHA512 f25dabb33e64563a114d4cab94caddb8f1b51cac719d2d1e3ba0de0a2980275b3bd12e5e7dbb92786f3cac0386c0a39c983b5c30759d7a5e06abd4579f285500
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2