Extracted

• • Target
    Quotation For This Order 091521.exe
  • Size 671KB
  • SHA256 bf676c0c2a4db1ca2df33c677b9fa836fb7bbd13d5021fcdf5bfeb2167674661
  • MD5 eaf3f62b2ac79bfceb8a07cf4f365c1a
  • SHA1 4677c5d1d938fa7ea97c0cde0c140fe66c5db6e3
  • SHA512 bb13f54d5ba901b50545c636b0ae0eba0b2352d7fb1428c833d291033ec8f5b0ee3fc7e2c66255df961ac968b8ef62be0c76e9335ce8404e2a54ce225734b841
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderp4seloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2