Extracted

• • Target
    009547789723_pdf.exe
  • Size 696KB
  • SHA256 a49278e32de8c758012e44c3519591a7997b261e453827ff7b11158786563430
  • MD5 270c6f09cf20137c694d939284f9ba7b
  • SHA1 f7288112dc0a70b38d109bda6440c0e3abb9b8be
  • SHA512 dade48e0023bd69f450842d32267a65964cdc819e6bb15a9232b56323e589dab4e407ce4b14f78c2d9eab7e717ecf9bee1985a3c4fa69acec2efac616d72bd26
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderzrmtloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2