Extracted

• • Target
    ORDER REMINDER_0000200.gz.exe
  • Size 917KB
  • SHA256 5c6bb4be3e5abfc077f779645b07502ad3f9357fa3c486db79d0a2fb4f470527
  • MD5 45c9d0fa726cf52d2de64efb2cb43607
  • SHA1 fe715a69fee4a71b02d16be3c2b5c561f429159c
  • SHA512 9d3db99dd4f5efa635d29e803ffa07eba384273928bc987a192c27ef5ecab004aa073a5858bea1bc5f2aaffc252b0fa54c4b5d9e8d0c74c9195503062f07c9b6
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadergnuiloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2