Extracted

• • Target
    New Purchase Order 0088870.exe
  • Size 296KB
  • SHA256 2edfa5f806d554457c20a6d48a519f96f8da0bf6d53e54556be1bffecbbb9710
  • MD5 8825cf6bafbc04a18bbda591e5ca95a6
  • SHA1 ec77dafad266b5a8fca01d534506ed8d83fa7376
  • SHA512 eb0991e175fd7016aba34251bd4fd21c2c457045abd018d47b8af9902768570e5bed5cac7d98b2f3a25b7a6a159908a7e4f28e2663a68cd84458d74e4f6e9ecc
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderng6cloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2