Extracted

Extracted

• • Target
    ARCO Purchase Requisition NO. REQ-05426.xll
  • Size 4KB
  • SHA256 ab12ca2a034e07fbdd6c9d6c31270f52173cd8559e12aad0aea593cc460867cd
  • MD5 448027ac61130d2e4d6db71e3bfbc888
  • SHA1 2119989b539ebe1cfcdac7a1d20672e7bf8f4415
  • SHA512 edd840b708bbdfb02bf8219ece6d9665bb9ef6ba7802d5ab9f07c7fa40c238bdd61d220ca8aade53a24e97f057b9cfa143179ffa8c1683ba4e66936f53c9431c
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderg5efloaderrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2