Extracted

• • Target
    Order-711493-pdf.pif
  • Size 296KB
  • SHA256 32202111654172f16eab4a33849af61e651680218d44e657b719b56789976561
  • MD5 7dc82eb8ad4d78c1fb2534eef4fb10fd
  • SHA1 a6f61ab9754a38151026dd6e94a97459723c8add
  • SHA512 7365a7a32a8c0227c70c93cc51a7a9235606af4c27acdceb531766dfad57b6f481f850b173f542c846d899f2172d60c8580f3febe3516d512500d3662fa92513
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderuar3loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2