Extracted

• • Target
    PI_2992.xlsx
  • Size 208KB
  • SHA256 c758a144ef7bd2ff92ebdf26a2cdca36d6b252bf4eb97d175224d000d66b8e4e
  • MD5 b37261611d833b5fff7a35ff65c0b8ea
  • SHA1 c755bf788ab93d91f6134e0800150516ee1471d1
  • SHA512 bb9af67f3f8a9020bd49f6544bc1a10b84cbe39dfbacd7245c70c84f9b6f8e055372a615c27e67b5338034fb5ad9d8d052218c4fd7c1e44230e415cd5cde2418
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderb86gloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2