Extracted

• • Target
    Invoice #00442811-20211029i.pif
  • Size 410KB
  • SHA256 ca205b38e2ee729d40141563bbb4200970224f4e00b380d5108a3ae51fb7eada
  • MD5 992fb2560834dcb308a6dbb37ced524b
  • SHA1 b05514375371a1989935160b72830122182e90ec
  • SHA512 67c1c9271957400a7013230fe637cf4c2f72d1d5bedab21b84f78aff45779795dce517fb90eff655b929cdab4d0dafd9aa4ac7b2a2546b199485239c45b9dadd
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderb4a0evasionloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Xloader Payload

    rat

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2