Extracted

• • Target
    UPDATED PRICE LIST INQ.___Pdf.exe
  • Size 521KB
  • SHA256 3336b511b906b02bae8c9addc0896660dbe98cc95a01acf0b18a9020953cb13e
  • MD5 84b957afaffae87fbe2207eee7841d67
  • SHA1 a1ad278aea85e25eeacf53b43b7644d31ada8f1c
  • SHA512 22925ffffb28a2ef1ce343e42576f9ea16c9f918fee39181f2d9fda72e6858344e6af08e4b8e377d643579ff7770248165686a0b13918103f31f7d79cfed473f
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderedf6loaderpersistencerat

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2