Extracted

• • Target
    triage_dropped_file
  • Size 337KB
  • SHA256 d567a6e6ac075533ef1960033ab07c0afed9638c785ccb3a9461195785ac9636
  • MD5 ce5a9b1b89a57e526ee1347645b25000
  • SHA1 a30d421092b052f05ad0861c63d720404805bdcc
  • SHA512 9db51bc3a0199f2cd374edd9f92c250dfb36670bd1bb76398241c1a0604502e00106c439cee31ffe0e79ee14e8ba89962e95a878e7f30c5bd855f2c8fe4afc80
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderfqiqloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2