Extracted

• • Target
    Order Signed PEARLTECH contract and PO.exe
  • Size 1.2MB
  • SHA256 2a3c5d424e042d82f295aba4197bc052355cbea30b0fa9c419a1cd7fb6c2bc31
  • MD5 bf743b8e013bea9379fa79b76aeaaf99
  • SHA1 a178460c272800ac7692564661ccdf9f3483e615
  • SHA512 f3594e336f95db27c1808749fa8bb9b74574545ab6417ee1c871a37c4027d0ffde7f64e591a36a9840786075d21be4ed55b142b84d761de13a343b9ff514ca9e
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2