Extracted

• • Target
    Invoice BL Packing List.exe
  • Size 789KB
  • SHA256 977576652c35a9f68bd5e609bc4628b521ee75dfa0b0d9d82deb6de35ad0d080
  • MD5 1ff46d48d359f79c2e52a9cdb71109a6
  • SHA1 7b9d4317d7539aeef7abb3b3df872b8423fabae6
  • SHA512 03654d2df2517c4419ec22ad79e842811f6abf7e16e61cbeaed606a92635759bbbec7cc31717d2d5e24e4438762a87ba46433295a982311269ae8fb3c2b4bba2
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderbmg0loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2