Extracted

• • Target
    DHL_1155Q9040 receipt document, pdf.exe
  • Size 680KB
  • SHA256 74b0f2384ab42a60f4e80f1b3f491989daf0571bc2a753b29dc8ceb30fd3b165
  • MD5 80d1a583077b96da617c7e4e6ed77303
  • SHA1 967114d03f625148fab24e99ae318d31f6a13701
  • SHA512 b7811e78deabdcc49f9d9052a9a86766e48a3a9d10bade6078d4f62c572a6000fd4de79ce3cd96f6998ed7e869907bc80604f6e125e577e0cbe577706e1c3f89
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadertod8loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2