Extracted

• • Target
    QUOTATION.exe
  • Size 253KB
  • SHA256 18e91cbaa2d04fa969e97e947ccd011d494f68eb6375b067f0342a7765fb3119
  • MD5 cadf879ded4e6a753d7b172b77bce50d
  • SHA1 ab4f8431c170d75040d8b2984f5e7eadeeeedab9
  • SHA512 c685444886b555978228cd2fb47b0725b25443b8fcd19be70f804a5bf433ebc9a35291ea33edf6fcc9030fcd26a89009a3b223c39432a001842494b20bf5f5d7
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderd6puloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2