Extracted

• • Target
    moni.exe
  • Size 606KB
  • SHA256 3a4677dc6f14f38983af15458b11d5f92e71dea8d5cd0e5b263c50d211a72621
  • MD5 7b2f837b3a3f8980901ca3a6f624d8d2
  • SHA1 7e0b1aabde14b6c64f8553d1d7e3499af79d2448
  • SHA512 677237124810c3cb0d35af23a2b9c0167d7b31dc0862bd7523841cdbc4c5209e5a71f8af8294f97e2bfa24f7d6984b00c695f0a5a5e1747833301b90fa1a46fe
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Suspicious use of SetThreadContext

  behavioral1behavioral2