Extracted

• • Target
    DHL SHIPMENT NOTIFICATION 284748395PD.exe
  • Size 521KB
  • SHA256 c2c8eb14b3a0b789a287440954ae52e8f72a5b0cff922aca1302eefff3dd689f
  • MD5 656041dde20cad9ca5d3b9bfd232cb0a
  • SHA1 a7c612db3dd52bbb48bac9c49899f22822d57e64
  • SHA512 9d500421061dfc60c23fa6d9cf11aeb81a991037171e59c3ea39c7b939c9eea8b51e620429de8c2766f0096ff03042ca3c0f9a5774189830ab6aa52ab1669a58
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderingaloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2