Extracted

• • Target
    Purchasing Order.exe
  • Size 983KB
  • SHA256 1e24e03e9ffdbe39ca8d357d0130aff5c50f2ddd7b2f613ab9dc01f02d0527d3
  • MD5 a514e1b9b6a313f06456520f1881c9a4
  • SHA1 fa44250d46dc70d4a3061a6174d697245411fc05
  • SHA512 1418aee3c4047d583dc7a2fd8993ddb25bba96ad280fd86f1c89d41dc9c4da65bbda5cb7f4dbff56dff9bdc651d98922f508408e6b8f746b6164a2b2fde3975a
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadergebgloaderpersistencerat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2