Extracted

• • Target
    CTM_USD55,000.exe
  • Size 229KB
  • SHA256 0f09b5a5ad2bf792ed543e2b170d969e40591157ed92b5766c3cc3ab7deb2df1
  • MD5 f3df2367a79e7f135a7ddaefb423ae40
  • SHA1 a08be77c9e91a124e251155643086b3a91f0364c
  • SHA512 7fac3bf55ceecb2c6c81d65485098164de00f977415b349dc198c2ef9145792032b9a27302e2cc1c1c1e7d5d33c9dfeb38d6c530f6d26e5f6e2eb505b0f64244
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadernoi6loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2