Extracted

• • Target
    aed0504c9e179c9d3ba15a64adc4bcca
  • Size 714KB
  • SHA256 cea073b0df1f1c1d964c4acb6755b6002976c05a4e9a059ca7f0d26da84ecb35
  • MD5 aed0504c9e179c9d3ba15a64adc4bcca
  • SHA1 1fc277575894e74930486179e5c8f4239f35f276
  • SHA512 aebae24d50e0c8f5b1625dc19f5790b20adbf28be497b17be49a9f73483fe1cd8b70ac6e18754460e777898f0ccd84a1fdb60f34043b75bd1d89493fe2f54757
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderrqanloaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2