Extracted

• • Target

    Aviso de Pago pdf .exe

  • Size

    929KB

  • MD5

    db085289795d7e9a90c5271efc2affd5

  • SHA1

    c0e48a77cb314f0d12408aac6c189851d35e378d

  • SHA256

    4a4480a59d046a261cf8b3b604d0c6cb87e54633aa784627643ea30ec3a63da4

  • SHA512

    6811f2b59a62da00890dbc54351bc8d2464a66dd302bb047a5b80e51058acbed983177a18af0acfe483b3f49501a15d855003bdf14b05425cbe676727e8eae0b

  • SSDEEP

    12288:yCOhcPUWRAhoubH9esjXXXsjSSRX00m2cdSkEtDNOwS0PE1c:yfcPU5L8Qnc1RRfzewSUIc

  Score

  10^/10

  xloaderuabudiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Xloader payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2