Extracted

• • Target
    FedEx AWB# 774174658339,PDF.exe
  • Size 511KB
  • SHA256 ea38a026b9c1764cc7e1028c9674c2cb6fef4c4861ba643976c686ea79d040f8
  • MD5 b23671714a2acee8b2056b92844b2226
  • SHA1 a48ae5691fa6c0ea89ea77f228325c62dfe6725f
  • SHA512 4567ca543c8e6b592ad55d0796da21c6d0160524da33c9ac8e02e3845f3ca0c3c6423db30b4ce66ca56f7ae6b04743379f590f14df3237634aead2a82d6d3878
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2