Extracted

• • Target
    PO.exe
  • Size 778KB
  • SHA256 0ae1df4d50a7ed640973980699737b85e8947baef0087c511b4b1ebf8bdc22ba
  • MD5 12c75354419de477cb232296a15c3ac3
  • SHA1 868c436a7d99cbe3c350d395ad9debeece5d3b22
  • SHA512 480d0bc253c7079dd3a63cd7df6826b375dba353de5b639b5072a5bb94dab3d0e2f3ffaf8755bb342645faa5ee4c6bd06307d1214d4d63e8e8ad90e646a616ef
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderimm8loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2