Extracted

• • Target
    Purchase_Order.exe
  • Size 813KB
  • SHA256 8e43a83a5cffdeb8d46e2e4cab21793cc15f2309f2fabe2d108d9536deae4757
  • MD5 ea743113b6e1c949b44c5efad6f1303b
  • SHA1 5a67e30e31081455cc08c6d9d47ba194b2b5c68e
  • SHA512 eccb41f4779c9bc54e407a1464f67c53e87aee716417cf493c1105efbad631b6f1a5c824dc34ea3f2da95351150952691584769bc006a39f86541d787fe953b5
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderct2tloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2