Extracted

• • Target
    Pending DHL Shipment Notification REF 81621.exe
  • Size 1.1MB
  • SHA256 0cb047df6b7a2df55972c4d33b5d10b511f707f30907513f07bf5ae2c070d534
  • MD5 2219442c3227ffa9ada120bb9fe9eb6a
  • SHA1 f32583503a9b5861c53024b848ec16bf793f9a01
  • SHA512 716ecffe36101898540373fa99ecf1a92787b9416e2b565be8eea97aded0f236ad48262eb03f22ee27af7efc480d4446fe1d49747624c2012bcacf7cd0370de8
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadersseeloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2