Extracted

• • Target
    DHL Shipment Notification REF 8032021.Pdf.exe
  • Size 1.3MB
  • SHA256 3ba94c54291623972d2c5e31bd34f3e5fbdd9416f2b34e7daeaf2e4fcb96506b
  • MD5 c3e1c8a11f1c23440c9ee23c85989f64
  • SHA1 789b0a3cb3490de11e6126b89bddfb99b0b71cb5
  • SHA512 95dbc42adc882c0f02daccffbaf55eddc378001b425cb60853720cfa827c4c0b500fc8f436dcccce6f85d481a7a31af55a8a85fac99ea9d50601d3a2da43670c
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2