Extracted

• • Target
    Pending DHL Shipment Notification REF 83021.exe
  • Size 763KB
  • SHA256 63abf2ffa58c2c36920a2be604c77ac2a25b2bd5d1d6ba9d81338da21418ff10
  • MD5 33c97bb9d3d55ff4ef6ba762fa549284
  • SHA1 59ee5f82d1c1cc78608083e905b8ba3380df8820
  • SHA512 75026620015807a1daec610fc2a44b6d83441d0b7500e272e48a2f36711acae527f7b63d8274d4f35e51df7244d9e1a71fc1e574b9afc0ed5f2531837394c61d
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadersseeloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2