Extracted

• • Target
    DHL Shipment doc.exe
  • Size 575KB
  • SHA256 ba852a2b1acc3b7c2bb98e6acbe41948de4e8046bbf6c3a874d7462f23d19f1e
  • MD5 0dbdba6f102e5d4b18518e7cbf4a2e38
  • SHA1 42239bf215805016ac0e02f049f6012718fee8d7
  • SHA512 a0ff8061e52a6adb7cf0fbdd4987c580c32b6115e534e51790ecb3d0051187cfe29ca7000720a0b7de58464c017f7a9bad17617facceba2881c7977480ce1a60
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadercre4loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2