Extracted

• • Target
    2292debf2685fda1410be586bd7d25b1
  • Size 991KB
  • SHA256 90e1eac40edda005fffadbb1d16c652d16e685f8f4cf7375eb6ac928222c3a1c
  • MD5 2292debf2685fda1410be586bd7d25b1
  • SHA1 1f6f41fae896c4193bac3e58bd34302cbdc2609a
  • SHA512 cc46678ebcd61642dcfc54c2c87f8bf3b9f96c7a364f97aa2bcd530cb89f5dcdc36face56f5927cffd9c46606f217cf98c608c3c5c562044635d4783ed19ff7c
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderrqanloaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2