Extracted

• • Target
    Order confirmation.exe
  • Size 1.1MB
  • SHA256 ff577215d4aaa29ae63860167282ceeb0a703daadfdaef2155102500c269caa2
  • MD5 fa3bd9cad3793c9cf8bdfac4159cb366
  • SHA1 54edf2049e0e177e6be114ac567b9a7c413a3b61
  • SHA512 a0ef4f68ffdf7e55a003e4bdf49b450ecdf4e4d92de4555e1fa0e77e5f2d7766b109a727ffde378ef9152a4198325c13af12a9fdf73f79755cc6398eadc42cdd
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderpvxzloaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2