Extracted

• • Target
    DOC20211005-0918629831.exe
  • Size 1.0MB
  • SHA256 85eb901d5863c16a7526addfb18464967c45348aec3e1d1bf6014958fa4aff8f
  • MD5 83a32d0d136cadf943aa605a7b1e3dc0
  • SHA1 c83cb3c6499bec6dcdf600d4d7e82638fa9a6cf2
  • SHA512 f19aa0e31154f48b191af213f3d0923ef19b9ccc1c0f3bfbeb679c8adbb18a2227d2262dd93686d2772f3775518c4b90795e62c63ded6e85ddcb58adae6842fa
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderntfsagilenetloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Suspicious use of SetThreadContext

  behavioral1behavioral2