Extracted

• • Target
    Maschine Angebot Resale.de.exe
  • Size 862KB
  • SHA256 a325ff051ebc1d366533e22fba4a75a4c0b183a28457ed2fea0841f68da06334
  • MD5 29bf3916fbe9efa5b85ec0b885995967
  • SHA1 cbcdfdf809c394e5d7038af945642af382f00eda
  • SHA512 c96e7a155fbb2a58a75bae49a831802b06d2483eada379d34d5a6fa94ec0f7a3a89c3c019618038211c0a453ac16c96a190409bfac48c47faed8014ae84099d7
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderhu8cloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2