Extracted

• • Target
    Order_Proforma09865445.exe
  • Size 1006KB
  • SHA256 c85eab78147f680f396925b005564604d84bcff97fec4bfb27e13071e791d985
  • MD5 1fd9cebb62fdfd2ee9533e35a6d14aa3
  • SHA1 d43f787cf9f8c5588f6c267d3983ca5ecf6acc88
  • SHA512 cc965a63a729e0be816c646155ebf201464b6d40362c9eccdab53a3653c361c829069b354f9e38dd24ac2b89ec52c7f733b825e74d45c34ec8b5588065888088
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderq4krloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2