Extracted

• • Target
    Signed PEARLTECH contract and PO.exe
  • Size 949KB
  • SHA256 084cb2109cff42297ef1b5982900b2022ccc35210cff2231f95acc0aec4e8e36
  • MD5 b825611dadec14ec011a54f1ecbb5585
  • SHA1 d879cec8557b9fc058741773ead69d5b585792c8
  • SHA512 0f6776bcbf884d0e441be8282337e0e928811ca47e21c7d1ef7a9797ddbdc9e463d4c5d73ee096f234a3901737bfe16197302a65c6c7064794ead9bc2df36c30
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2