Extracted

• • Target
    PAYMENT_xlsx.exe
  • Size 260KB
  • SHA256 ae912e8263a9242ff6590f2c818cdc64c3a6f2f059576dc8d760a3af93db63fc
  • MD5 903f090170c015ce8a923608be5f5529
  • SHA1 ca5ab369fa9fa10367f8d2de5530986dd5add4a1
  • SHA512 fb716c05053f9643ebdaff1e5a5a3d9b88cee77c1753a51618ab3c8f7897cd79384250edbe49cad6cf86579b83dd317ce2922674835ea3d484a0fb0f79f3bf6b
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderdtt3loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2