Extracted

• • Target
    f8yKXi4whKaPo8e.exe
  • Size 708KB
  • SHA256 39e4d2034ff07b9ba247022d53f2e8444e2eea2eb94addc571d004f59037e3e2
  • MD5 3dae733afc18d35625ee8d2c2705ab09
  • SHA1 c1d1f098459c989b83fe3e0838a90aa85eae0cc7
  • SHA512 2b227721c03f92ffeeaec9d5af2896b973c37ecd76f2de93076b97f01d737867ab7ec3fd0855fe0ded0c5233b9dd7d91808cafb2adf51ddab24ed449e6d6092c
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderc8ecloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2