Extracted

• • Target
    IMG-pic 0699821.exe
  • Size 1001KB
  • SHA256 e07717afe65c94d4cae860225c8d6aaa4d3bde732598d34c96f98ff927e1d489
  • MD5 14f80d04ac41196b969f4a6a60016a5a
  • SHA1 7fbf938dcb3c873b4e6bb0b0ca00cff825c59d65
  • SHA512 d2c757df0c99e93f40f6000cdf64493d62ee41f32471091800616f1aaca1063cc48c1f0d26b6d5ea2a5d44cb636b6e86cf4b1dcfe540242cf8640b17c896642a
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderepnsloaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2