Extracted

• • Target
    40988654_INV0.exe
  • Size 839KB
  • SHA256 634f51d38eaeb5f38bf45b5dd8b09ef1413bdec23fd2223c0bc9e4767ee81158
  • MD5 6b8c5ca9a210761d6a596da35654a61b
  • SHA1 5e5a33b9ef25d92065c6f89920bb4b6cc690033b
  • SHA512 52e70b69864680f5e1a44c4bad09f97c83781ee7b27ee9d8799229e524f76155b1e7abd9fa850064ac97c930b8e499c37ea0566f503b149be60aa85290cef864
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderq4krloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2