Extracted

• • Target
    Dhl4500001.ace.exe
  • Size 791KB
  • SHA256 ce80df3a4bc48726d4cb9365247b06678da7972d8473a159b1db32fb66f48a82
  • MD5 7f25042339f87e52b0cdcb42e96760ee
  • SHA1 797581549e9066af6a060f1ed2a38364e45ee316
  • SHA512 2f22262c8ab4f4f96b24f785d814c63362d2a8d9a9d5e934ba4d5c169b70a488ec6c6f52a7d063662728a691d4e8a1b64c0d94c78c05d1c2549a39c818813709
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadermwfcloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2