Extracted

• • Target
    MONTHLY SOA AGENT MAR-MAY.xlsx
  • Size 181KB
  • SHA256 3d0b051be972c82b4cce6dc0e6c79642acfe287c490b5072521dab13ab530f73
  • MD5 eeb2aa03e7ef895d190d3df61a5fa9a7
  • SHA1 4a99acbd22a42f0f646fcede1ec17c1a04d4fefb
  • SHA512 845c30d0b231dc75e0a87c6086b0a3957d0ecd85151e0cac6d02a4c543c2e927cc62afd32840881f43acb413da86f0cfd5d8a1ec2c66b7b0b3ab8126399e411c
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderitq4loaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2