Extracted

• • Target
    Pending DHL Shipment Notification REF 81121.exe
  • Size 677KB
  • SHA256 435b924af18dce67e3fbc2b55fc515b839fe883da2e10fd3c8c21859a1181d64
  • MD5 3ddba9dd096fe52fcd90d41478bfcba5
  • SHA1 43c708bca3d1bb944adc81b3b7a1f7b2fb80c4f6
  • SHA512 5c7e6ce588c3236370b88a385733301161b3ed5869e4cfbde5b7d6b04a1c3b1f4ae4ae5c268dde2923bc4c091f70edd19cf14cf4995de19f19c27cbc6e064feb
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadersseeloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2