Extracted

• • Target
    TPJX2QwEdXs5sTV.exe
  • Size 655KB
  • SHA256 7c3d5ebd2c417a52b2a0b98dee95b5a7f283816f6a2453ceeffd31becc140882
  • MD5 ce556ce97ea23cbc2940f2aad45d468f
  • SHA1 cc2bdaefa2f0ac108e2f456e42a42e8258580cf4
  • SHA512 82d4d71aeb5118d600394c64eb127ca4a87d7b83702feb4f9c5b0a0d98a597f812ebfd16784cbde54b9f4b1c87d3c7eaf57fb1c86b9720df95419887fc13f77b
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadert75floaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2