Extracted

• • Target
    100197.doc
  • Size 190KB
  • SHA256 59de39d60fee5b2a853c4e4bd62ce6ea5054373938b8afbb159d60102f88e989
  • MD5 a51beb4cee3604bc8ab1c7c9f5e7d5c1
  • SHA1 22d24e750b96783e24da802dcac3e4367d83befa
  • SHA512 c406ee9bfb3425caf97e26626dbba30aa7a305be0f1732f2a7b4225e877468a0b12aa531d0c495bb3aac6f192966e92daa419ec01ec94e5f5ef50a8f851fc543
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderunznloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2