Extracted

• • Target
    Dhl _SHIPPING DOC - #0036284639289.exe
  • Size 953KB
  • SHA256 fbe213bf476b15f3d10fbb16a504e65fda87479b7947a2c38f825eb083a08379
  • MD5 973a919df1a6335176f58ff660e1c647
  • SHA1 105c5529030c2facdc398fa05fb160fd2b2513a7
  • SHA512 30d6b3609cf099802e7b34541a6e4edda9a3271c6b0f9ac2a710e9e760764a2e82dac64660a962b82712952985485a47de7dbf4b61ab1e0deac89af6e98cdcd6
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderingaloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2