Extracted

• • Target

    2021-04-18947 OC INVERSIONES RIVASOL PDF.exe

  • Size

    844KB

  • MD5

    e12a4d95a3ee125919a807f7913b19e6

  • SHA1

    a026aa3538d4580c55d4816ef580d96ae9951788

  • SHA256

    b13a9b07dcfd6677e3092a0cae29b08487bb56d12345f3bd13931f2887b1738c

  • SHA512

    c4479179a68c9e0f921f35fa7158a91199697f807b36a2d1704c6e34f74770965113c296d5e93ce0a827db9100fa60e4fd07c8bf40ac49c89c260689036ecb37

  • SSDEEP

    12288:Y6VhCe+/DPYjaV3m9O2SSIuHwwHjdlnd5gzKa9TEFLYjP+osyn12G1Ps0heGdMGB:YbRjYn9OxSTp7QKiDqR4bnhemt

  Score

  10^/10

  xloaderrbpidiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Xloader payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2