Extracted

• • Target
    FanCourier54488203expediere doc202177.exe
  • Size 260KB
  • SHA256 bf8bfab0557ff010ee03db046d493da9b0deeaa5e5fb55d9e5750f280a0289ac
  • MD5 4c7f34b23f003c872c8f2d05fc76ce15
  • SHA1 d9b767d6703a8ed0d99e666c360a104c6dd4c1f9
  • SHA512 66f088b1af7283a95696988f2b041a44a33045701e559b31750a0f27f28b3470bb26a089ef256230612f6dc4f47ce110a05d4480279255b037370e894b4c55c9
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderni8bloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2