Extracted

• • Target
    order.exe
  • Size 730KB
  • SHA256 4b6fb9eac1ea52e013bfb4061a1232fe0d145bc9e260df9bd0d76b1a31be78bf
  • MD5 37bfff255b323160a222c6573121a826
  • SHA1 c9d5a770db875676f3ea062bbc6de83d4d8b5c2e
  • SHA512 0a821d86618812d185c9952dbd14da68843efbd2fccb6a94e7137b764f04f72a4fd61861fa0fd95556a5f46456d7da311a8bd0d1f6aceac556a82c3c2a671c4d
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderangploaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2