Extracted

• • Target

    PROFOMA INVOICE.exe

  • Size

    866KB

  • MD5

    24736913b455be2ed3d1cc67c767afc4

  • SHA1

    8026db0f265178cf013ac579c1b7267f4014bf2c

  • SHA256

    a109f0b9407728fef1b41d766e8228085ee04661156d84ef543777bf311f450b

  • SHA512

    49dd3e5ecbf6d4cd310a45d0b52e36a363d701f0a9cc14a1d3c103b613eb5a756fdc9ce8b028d69b56c4c8137d29ea3d57865b4ff75dac44bf982e5c80ee56ee

  Score

  10^/10

  xloaderc2ueloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2