Extracted

• • Target
    Order_KW#PO21192.pdf.exe
  • Size 457KB
  • SHA256 6b7c57bf4436d26fb957f0bdbd399df30e7e5b20f2c78f01b47cf0c06f3fa54f
  • MD5 54a2ca73414751e87d8a05bdbd369dc4
  • SHA1 b8ae6a00d413f081e70b97589468eb39c68c1ac6
  • SHA512 14b5f6e32384e16b1ac2bc3bb139a5ef19ec6e8105f5c10ac5f13fb32d0ade9b22339405722938598e68e9f961ebf68b94d55b1b5b2eb06a582cb97d5ea9d700
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderhedsloaderpersistenceratspywarestealersuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader Payload

    rat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2