Extracted

• • Target
    Lista de orden.PO9876543354.PDF.exe
  • Size 800KB
  • SHA256 96e14fedf020cef802a005cf9289d7c8f8a0f2bd516fee5f4096cf36a2f2c1e3
  • MD5 51c6709cd33cc68226450140b2d2d02b
  • SHA1 573d6fecd46c30dac8c337ea8ed9ee218980f0ae
  • SHA512 8a827f51367207df3415696881940e4944273b4c8b6a19a75b76b4c6fca6ea962ca95a26f5310e77eedadb3040992b6f13dad567a6a046ee1ade9ec0e33d8fe7
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderpvxzloaderpersistenceratspywarestealer

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2