Extracted

• • Target
    280322028656,pdf.exe
  • Size 1.2MB
  • SHA256 7a975e0983903a474303dfbab00a6ccd3a5f9f3339fb1d756aa36f5172361e7c
  • MD5 e7ed517edb255b2b0b90165552d7f12d
  • SHA1 8fefb192e7b649e7851bc6dfc9bb98cf080e939d
  • SHA512 df798917c327137544c7f2039d52a72b40b791d5e93ddcd9e24cf5ea0458d048798d3992bb6b16a2fb38ad94164425cc40e5eea25b00d02e3e7c33737d70754d
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderp8mcevasionloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Xloader Payload

    rat

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2