Extracted

• • Target
    Shipping documents.exe
  • Size 737KB
  • SHA256 82d5d5ef76ff7a708df5ea9135cb18117428ad1cbdcaa938989a3559a6ff5b97
  • MD5 a734d30535ee8514ab152deef396f37a
  • SHA1 0593ae2d5e74331ec73e037c77eb9da7ce2324fb
  • SHA512 99ca59a6eb304ffed4206db29fd0be29c00cc3ad37cb22fb82b28cb4f7121cda86646f4f16ef504a46dc2590034f44dc296df1b21c385dfa6f385c5927c682e6
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderea0rloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2