Extracted

• • Target
    Statement of Account-Invoices Overdue.exe
  • Size 1.3MB
  • SHA256 f5e7af62bec34825a548b4d5f39f65efc22905c4806efa6d35e1e0d4b02dfef8
  • MD5 1e737dd92af48a779d2b9b394017603a
  • SHA1 f22a3534913d994fb5c05cef3a6b621b5982fafd
  • SHA512 defcc6b273a2aed023af5892396cc66241ef01eb0e984edaa408bd9cce2e11230a83186dadb58439c097fcec08625cf1d97fbd02a32b1abdac62cb6db9485531
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderposgloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2