Extracted

• • Target
    376f198af24796bf500848fb66bdf471
  • Size 1.1MB
  • SHA256 c11992880daecda35958fd14fcf3b6e5d32a6bda8c904a888ede0dcbb1f91aa6
  • MD5 376f198af24796bf500848fb66bdf471
  • SHA1 5eeda205ace7bb30192333ec9474d4d897752354
  • SHA512 c11fc4c0d7068b5e81c65f7e6b76d45dd5514932ebca986daaacd6b686c0c62efe1d0ea8b834b232c0c2611e9ce8206f67afdd99c01506e686d8a8b4ba3e9977
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadero4umloaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2