Extracted

• • Target

    Purchase Order.exe

  • Size

    746KB

  • MD5

    fc644e1753c0f510615c969a037a53df

  • SHA1

    594cf60d934b1aa008a24608f2aa781238d5bf52

  • SHA256

    766f746c512714ce38f8d0d43f7a0aba6fee673b77211c11542f5133ff25ead0

  • SHA512

    0d5ebc07a9614ac71a5189fee599d4ee8b05603ec8eecb06a6c30b723f8173df9b0b096ec2f1ce68d510422089a369b1713f1589600a47877edccfb0417c11df

  • SSDEEP

    12288:Dj/+raF5JN45uvfRqCdXb6GYkExocVDKl4IVBzI9bH1FCDtWHmawPuvnCuxFn+CO:DjW23J59dXb6zBxocVmP89jq

  Score

  10^/10

  xloaderhow6discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2