Extracted

• • Target

    proforma invoice.bin

  • Size

    952KB

  • MD5

    e47b1ea33b1abf2f4fb8ea4033085f5f

  • SHA1

    b03c03eaabbb7a9f400004115a80087f49c7d24d

  • SHA256

    2f149eeefba021804e56e884c6a0b9b20a0205104976741b9f7255ec60e4872f

  • SHA512

    e4ec9343ae245a4fa2ba47250cd334adb15a8071df54b6eec5db3f5214044135cdee3da0d17873df7837f567b1fd38657d19e401e39222f34bc4966db979e033

  • SSDEEP

    12288:9iDerSToYkbL9AvIQYci7fep8aLBdi1WWbdNIQvr5I:99bJATYnCr21WCdWA

  Score

  10^/10

  xloaderxftsdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Blocklisted process makes network request

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2