Extracted

• • Target
    PURCHASE ORDER_PDF___________________________________.exe
  • Size 528KB
  • SHA256 d647a2e8ff08785b542bd885e62aed69fd43ea2dd801f5144bd990ec8719f3ed
  • MD5 abf183eb397213a2f781fdde0a7740fe
  • SHA1 8c096b969627ae93588daeab1b27e29be56b566d
  • SHA512 8dd21b61e01ab225297932ebac52c93e2b5f0e39686df6aae872e17e74245fb71eb667879dd2305fdcda012e68758799b2105099cb671bc8e94632a269c21ecd
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderihg0loaderpersistencerat

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2