Extracted

• • Target
    DHL Documents.exe
  • Size 591KB
  • SHA256 e696b557dc43db7009ec7232a19ae4ba0c6c8f131a517dae7a2bd0fd996d08e1
  • MD5 ea6122fd61138b4e1e68fc610eaefd5c
  • SHA1 69bdc7419578ac473f3410bf324d04cd9e0dac0d
  • SHA512 acfc43a66cb10e337c7203d9ef9d322864f1a4f0828031c0f6753332ffa23f0d7392f494a326a293d62894d3235204698c0bebf9aab2409b093e2cf4e5337b52
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderg83sloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2