Extracted

• • Target

    TNT Original Invoice.exe

  • Size

    759KB

  • MD5

    03fe2e5b5e59253d0815b2e121fa1e30

  • SHA1

    eed9bbbb504bf208449c764fece9ccec3f23e771

  • SHA256

    08e2b0e469f2809991e59e65177fe994f3aeeea601a2af8aec6c7ae1406debb0

  • SHA512

    a032b27abca34d611e4073453e04d9b2ffcfec8c239eca5aa10203117013b1b872031ac9ac42ebb174acd8acf49f6a1505940826e1900eef05fca1cf6ba6f09c

  Score

  10^/10

  xloaderzqzwloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2