Extracted

• • Target
    Payment_invoice.exe
  • Size 638KB
  • SHA256 08893f139b09f2dc17635f17baf1f34d2fdf730ea44a41ba54b914ffc024f0c9
  • MD5 29645cb14447ff578aaa9dc4243f11e6
  • SHA1 cae1f1cfae48a35897e6c64b4f5b3de807af9aa4
  • SHA512 36bbcc580af0e2b33bfd351fa4693ed40ee9485d099767612e8d45c6e0643f28f3b39915a56f98529c9ad8a4e16dd6888144e6ba9e6ccd7e3a765c27294e01cf
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2