Extracted

• • Target
    DHLAWB9678547836.exe
  • Size 249KB
  • SHA256 3ec75c58983e9fa89e37b733d2dc7d3ae966b52066bcb8662cd47277fcae1aa0
  • MD5 c44129401026d4ebcbbe405a6a20e87b
  • SHA1 24f457f6c34d9b203fd98d9f772ea76b61cb2d61
  • SHA512 3494ca36bcade13d74fff4d61ef340359552ac27dff5d423f349358ae382755865fedf59e3ca11dfbdc205bc85f79408baee486c8cb4f0bff806aac25706a73c
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadern49hloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2