Extracted

• • Target

    Invoice#00086770.exe

  • Size

    681KB

  • MD5

    9959299149ec0cc5d9c380a308f69f31

  • SHA1

    2b98e45b2dd60c8e3f154e80f10b2bcc07bfca90

  • SHA256

    b9e50b873e6ca85c0ebcd953a403425a5c7da2e57ffe47723e21cccf8cebde06

  • SHA512

    60fd97abd4fa62686266cecb9832ba50118671dce411dfcda9dc7b6db516eb0405a0783739fe1e9e920feb90e51f73b0bd6a9cc9decb75288edab0923b87ada1

  • SSDEEP

    12288:w5cYv2tasGHW/NqrFnHqgpztNwN/wgHQHewItAVjmRg2W9fvEwsJ:wvutasoWFEHjzIwoQ+w9Ycf9sJ

  Score

  10^/10

  xloaderd8akdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2