Extracted

• • Target
    Proforma invoiceShipping documents.exe
  • Size 1.1MB
  • SHA256 c71e73a5006f03bf63ad6099f034a3d19a130a6893979c43318eca2cb6bfd224
  • MD5 199fb0f822a8e86ff1cfb61d9051414a
  • SHA1 848fbf31e11e6deab665076c820169a8f0ed730c
  • SHA512 9ee4e9c0388c84e36f1cbb84259f9c8dfc54bafe2185afa069414c07cd109183e83e5081773ca6071620ce56ccb41cdec10a5fbce3662aa40ec0953165c58d08
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderb6culoaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2