Extracted

• • Target
    wire transfer.exe
  • Size 590KB
  • SHA256 6b34b6462f2ddb5cd51c1a06addb5a1fd3f69e5ea573bc2ab3d2eef0ac761022
  • MD5 a4524c060b64455df18a31aa5f83d58f
  • SHA1 841bc92461ac9c6fc2541ab9951f13d91e40b9d2
  • SHA512 a25caa86fedf9609377c8498e1bc270222ab685f1c3a18052b7df586dc3f16d77eab030e2e304feb9ec550d089014146beaea78ab2ff3b9627682f2521bf4e31
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2