Extracted

• • Target
    INVOICE.r15
  • Size 440KB
  • SHA256 824dcdd9992d95e8d435c223f7ca465647106106c1115cda058a75a29dcebbdc
  • MD5 4833a3dc62154363ea11700ad7d1e6f0
  • SHA1 95114e7767cb887d2d55b49bab12d38faf1feba6
  • SHA512 b3f958882be2fa26ecf5943884f58edf64816904d107094fc5dfccc3a9827b16efad13797241ae3e73af5b9696fd8be100ec502f1de5909a3550c850eb0c68e2
  • MD5 SHA1 SHA512

  Score

  3^/10
  behavioral1behavioral2
• • Target
    INVOICE.exe
  • Size 1.0MB
  • SHA256 b40f99b70dfb48d4465f825207248af9d1cdc87166bc7b5adb73a3da72b0df93
  • MD5 8b500a764ff3b7f2a118b197c801b0cc
  • SHA1 3fcbf18e9a1d6dba262ab7675ce42c03a142a220
  • SHA512 174c850f0bd3fd5f38d1a2288eb48990cae3a1024dbcedccf74354356dbc6808f1380c146eab5520c238bb571575aad5e5a4088939d4a23a720002c07da5b57b
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral3behavioral4