Extracted

• • Target
    foc invoices.xlsx
  • Size 187KB
  • SHA256 c42cf104671e10e810e1449e15e61a3090a9c7e4512caf451abad95b2a44af3a
  • MD5 b321c5a3cbabf31a5bae2094263dafcf
  • SHA1 02eed889eb4c601461b78567f527da76536cd6a2
  • SHA512 c89f317c0923bb4638639a4ac85efe6f251f004597eadeb807ded57245541425ca425e99cd49eb0a213982385831523f11fa0638e60ab6d14c13596072020db1
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderjdo2loaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2