Extracted

• • Target
    DHL-Waybill.exe
  • Size 318KB
  • SHA256 70b60d915bfc7bbbf6087ce59d289d7cf48a4c4b8a5e03bc5c24a2f9b7eaf915
  • MD5 db27cc069ef56aed54594dd6691cae9e
  • SHA1 12fc7696b8a5c8111d971a3e0dbe4cfb1d78c97b
  • SHA512 8933c89a931087002ea40a0f1970376e8b3297e784fbf2fa505225542bc93648316a082c8362c0d854d07fab988d048f4976fbe1973e52573bc900a8367917ad
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderb5celoaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2