Extracted

• • Target
    Order Confirmation.exe
  • Size 752KB
  • SHA256 13b97bdc5e28d592ef42df9b6fcd18514bcc38ed26f28ec5943dbbd479458fac
  • MD5 95e632b834c3e28521bebc17202e23bc
  • SHA1 57889298507367bdbb357daecddbd4c43295886f
  • SHA512 fe130eda54d23e2b2dcf7bc9439f0d1c8a659246ca25f1aecd6b80698136d718df1ea612bc6b4884e8c748dbf9fefb8b32d5d04dc9bc9a8aacbbb80ec2ffee49
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderccxqloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2