Extracted

• • Target
    aa4b9c043e923952fee38447b9dd0b43
  • Size 690KB
  • SHA256 7f7af3d03481bb68e11a68e958ce6d8e96701a053eaa458e7010a4a85643cad3
  • MD5 aa4b9c043e923952fee38447b9dd0b43
  • SHA1 14b12aeacdd0ae6ba8e1215c192f513c29bfef6f
  • SHA512 eb0e81bb8f107fdc91a35f9c65d42ef3c57356c6adb62e62b53828984c81f593f301e8f2650c0efe2077346ece9afa00171f0136b6b1981acfa83dc02b8e1c73
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloader6mamloaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2