Extracted

• • Target
    เอกสารใบเสร็จรับเงิน DHL1397070,pdf.exe
  • Size 662KB
  • SHA256 676f651c6b2e0bc3be79ddfc7c5ce1da527ccb97421928f1b806962c24a5fe50
  • MD5 550d1a4d38f88d59a60a03682e55ccbf
  • SHA1 9ce5439c2148c81c943699a2e7a752a23ac8ac08
  • SHA512 fe075d26814f65ab30c276f88e65b79d6255320a85bdb63cee62c8f91b743ebda79db511fe7f7803078cc5283874519d58582026978164050e6e5ad5ddd5cf14
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderapg5loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2