Extracted

• • Target
    BhVQ8rqxTUy5ijy.exe
  • Size 724KB
  • SHA256 7b858664b4283d8d0be155dc6bbe9f279e066b6cf2dd985eef95698e77333900
  • MD5 9d27e60dc877f280ec4bc6b4c320741f
  • SHA1 2e6290d850de69c57a1a73bae251d550e5223e7d
  • SHA512 45ecb5ddb4af8b9cd7dfd1ca8432dae3bd81f9d5e9ca48a19cb100399e209d7da28ad015f0fab785c0c3b7d93655ccbf494e19b5c8143f4d7150a0fbbcf5d069
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderjdt0loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2