Extracted

• • Target
    PROFORMA INVOICE_PDF.exe
  • Size 718KB
  • SHA256 64c7583a94ab474b9cd3509e8ca73eb7a19e70ffc2c4fa4582ccd7fd3f10c5ec
  • MD5 076375a538b587ac4d6297ffc2c8b58c
  • SHA1 e1b0d3265fa30eb2cf3d207cb550b884963ff475
  • SHA512 8dd8f67a728a13b6c3928dc845213dd0ba0ce31b97f8dedd2c262c72483fc8674a619aa969f4275184de1ad7e1b75aff0fd9bf54a2b622a56e2827ec8c6c912f
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadernt3floaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2