Extracted

• • Target
    Invoice50001.doc.exe
  • Size 411KB
  • SHA256 86fe5597dcc6944c5615838866eb7d68d212bc87200c9ea1a2e244755d8fe410
  • MD5 6972751818d7910e6695d58e735ab552
  • SHA1 972ce62731fd888600e37e6d9675416308f14c84
  • SHA512 c88a29f279a911c73ef2cc6db77b706c4b63d08c8103c3949921fde367a82170c290fa95c358c08f4bdefa84e3c713f28624b907daf61edd2955c7ea8f643663
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadermwfcloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2