Extracted

• • Target
    USD INV#1191189.exe
  • Size 376KB
  • SHA256 b09fdc39338aacafb7eb0163757d2b9863f78e5467af017ff4ad2f09e0e266a2
  • MD5 e8b1d358fb7f80a9a3d4cf79156eb585
  • SHA1 da993079a89eb6d478a8df4cad7ddda4d6756aba
  • SHA512 5540ac0890a08d0b3c65d56eba2c81a6d12c6e08bb7d0fb84dac4a8da708f64cb7be90a9aab12bf480ba19ac0e23ef110a94c29013da52ff287c751744fbb30a
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderb6culoaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2