Extracted

• • Target
    DHL shipment doc.exe
  • Size 809KB
  • SHA256 012ac67f5277ccbad1b30abc6e5288046db94d7cfdca31a3cb7197582ce5a480
  • MD5 828bbbf70f2e02b8fdaf0c264390f393
  • SHA1 dca6bcc3aaa9bd97b8fce20ce6ac226b0ac6da26
  • SHA512 b3a6c698fa6021749573bb29b890e59697c99667715d2c96fb152e21ead4a27202c2e813abbc6ba51df5a1a4fab5d9007da55c2bcde7ada287a2ee75fd5a7918
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderqdq1loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2