Extracted

• • Target

    DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe

  • Size

    30KB

  • MD5

    c2ed847cba51543076504a7150261f22

  • SHA1

    93e063e8f777b42cab7f7ed8fa45a2397942dead

  • SHA256

    dfe742ea984310b86ce1d553b87e63f4cdefcf8485b7c860438234377a10a358

  • SHA512

    4dca34f7a0c0ecf2018de5a0e2ba5a9145cfdac508dafa1f5de5fad4072703f6621587b164a742d094cb557e8cedba5630cd7477fbf355a6311ac457c0cb5670

  Score

  10^/10

  xloaderpo6rloaderpersistenceratsuricata

  • Modifies WinLogon for persistence

    persistence

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2