Extracted

• • Target

    document.docdgklfwia

  • Size

    21KB

  • MD5

    7eaf1191dd524f013b3da5637cc65020

  • SHA1

    83f34f15b36102026280e53cb2b44cbb24f03104

  • SHA256

    177d47fb1686f807548d86cccc3c1783125a02b197e827981e842a7fe273fd13

  • SHA512

    670f3fe1878a7e478321e3c7baf2c8833891b03bfd56afbfa7bcc9cf4b81be3ecda12c51a3866c75ae18bc7074f5408a334eaf4db67d5d466a48ae390889f702

  Score

  10^/10

  xloadera2c8loaderpersistencerat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2