Extracted

• • Target
    Confirmacion del pedido.exe
  • Size 714KB
  • SHA256 34443c2f4cf165f96c3eaffb93f2a7b3628ebed8ed119b3ef2ad3e5dc450e0a0
  • MD5 ccd3033369c99ff56f71d9d8e3aa80e6
  • SHA1 bc325d0a1cfdfccb5816b8fb9f77fef0b9493da4
  • SHA512 68bfda7b188cb25acc75af7d86c25b30a19ce00d53b16b50df251bb289280baf4a467266323a07f19c9dcf5eb9366a0e5c8c268d33598bb3d40864b24aba085b
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderpvxzloaderpersistencerat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2