Extracted

• • Target
    DHL Shipment doc.exe
  • Size 380KB
  • SHA256 dab25e8c1516ece436f339c556e488ead016d9e7ba2c3a9d8a78f47ab19bfaec
  • MD5 7e8543c4b89504e2cf047e05618b38ff
  • SHA1 9efdd11a63c066818dbebb45fa113cc34ca29e52
  • SHA512 b0a4de836a845534e161c01d3774f7de4c1ed76115048edeff9584da383788a0f3971f1b69a0a34b9054911b72354a7730f3f0e082c66360907f836ab3d0486b
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderhow6loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2