Extracted

• • Target
    PO.exe
  • Size 348KB
  • SHA256 fff77f3852a66a56bad4ec5bc1c1bc2afb0b08b8ea65393384a1ee6917dcb355
  • MD5 ee61cb46b439d17909a37232d4ac614b
  • SHA1 9f9e8b7c5b287a55483aef583a058ed7af5d2fbf
  • SHA512 63295b930c804932f6cc116f93115e1519fc8d7f4944483e07c78b207cea28e60dd91dbe340231a0e96ce96fd8b727871dc3a2cfb7ad5bd1d983eff482b2eec2
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderriholoaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2