Extracted

• • Target
    QUOTATION_doc.exe
  • Size 1.0MB
  • SHA256 a67796ab32ba225ab871923548c5b98147a848edeffb72089724d6131d20dc0c
  • MD5 7c0902852cf17ae5d05ea35d770dcc93
  • SHA1 bd57aad081ce20140b226b878091164eaf777e11
  • SHA512 12226734d0bf22c9c8d70df2d9f308ba13f44f1715c0fd7a033fe90b32f55d33bb0794aa41259bef5a626604d3c23937b8d97d9b35c6a6e5546ae2121947cef8
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderht08loaderpersistencerat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2