Extracted

• • Target
    DHL Shipping Notification-pdf.exe
  • Size 1.2MB
  • SHA256 eebf2b5d558c3f39f52538f7d3175c732f38351dca734eb37bf975796dcc086a
  • MD5 972c10b3ab4db3207f027df78a76cb86
  • SHA1 f53e4798488151d26cfd070d0cc7e50f5b5950da
  • SHA512 5a30de7125d1ae7f25ddece4defe9bc109f83fee53112e8462b756ed805495f985d3795ac997e770e61a807bd09c9c06bc5e167f12038e035b76cbb8dee1d785
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2