Extracted

• • Target
    PO.exe
  • Size 558KB
  • SHA256 2a9f1febdc4e074beaa1b6b761d09900377204da7a9f1cdba39284d568e2ddc8
  • MD5 993fa8f68425daf6a616445873aa11bb
  • SHA1 2bc2e14829b1a93d901547d6c43a167181c4e9b7
  • SHA512 2b51ac0e416bfaa080ae9338a7177d99d830442ee883c264b7fb342e5d9fb953bb7bdb2d848e431886f1070be41a2e3fdf73243f97cbd17a8daeebca4a7c6457
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderbcwgloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2