Extracted

• • Target
    DHL Shipment Notification REF 08122021.PDF.exe
  • Size 832KB
  • SHA256 fd151f1c914b41e565c1dfeae2cab5c77fdcc885b83c46e30b9fe3eefc68efd3
  • MD5 638b6ebd151367c3edb3c71446f69dd7
  • SHA1 940e938809b6cef36948df102cb4304969c2f58a
  • SHA512 8b5ad4d87c24bde0685e6f458597a3bbf3df1892c6de08e22c66cc7f84ff650ab2e7917cc172f3fa85917578a28749b7c2ad844e80b2452ee35c0d13d242b6f9
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadergno4loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2