Extracted

• • Target
    Released Order.exe
  • Size 503KB
  • SHA256 7f41f56fccf71bcb0c1f50d11e9d05a0342cd08a3a27d55d31cffe0ef95b2272
  • MD5 e2bbb850c21363d228dc24d273e1a8a9
  • SHA1 fd22b3c7eb8baf4a5f73cb32340c1503cc5d2b2a
  • SHA512 9dc5863692a3c505f3a2856ebe1cb2bc5bc33db5293393cf004e45f90b0dbf24eb85248464a3d3d849c33ec7e310e022956ab7c295136bf0ee3bffcd4874e098
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadern58iloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2