Extracted

• • Target
    dhl shipment.exe
  • Size 982KB
  • SHA256 b8e835b3ef97bd5ba4f5a1fa76637a11acc301d317ca87dacac8195f19bdce83
  • MD5 e3dafbfa7aa451fb23d1a4e4ef972d84
  • SHA1 2e1b2b48179697cd17028deb24386a4e8de64cc7
  • SHA512 35322664f9af0a915f55135dc708c34033d690550110234f572c4fe0cc270cf66c6fd10091c7f9f9e68ed0d1bb5347c2a2c6e6c5ea238cc3bb8749c728cac593
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadern5fqloaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2