Extracted

• • Target
    DHL AWB AND INV.exe
  • Size 374KB
  • SHA256 0450f9017a4e7556c6bbfa5e69363ed935e11fa47efff5755b172103b3b59892
  • MD5 126ae728ada77b821a6c92c47fbfdb5a
  • SHA1 ab6c53b97d055e52bfbbd99e80947adc1ef00853
  • SHA512 411a1a314b1bf8429a9e4f995f36fa0542ae11594937d93a7e6d12a4df4567c2ba907da059541e8588e00e35848296760f8891f372b92ece01e8bc11d8fc4e82
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderuiteloaderratsuricatapersistence

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2