Extracted

• • Target
    triage_dropped_file
  • Size 941KB
  • SHA256 de43df6bd459b56aec0cd86e0873cc0c5b556e08547e2b9ea79082c44d9b7220
  • MD5 538af9b3eb449aaf53eeaf6ecf3c4037
  • SHA1 edc27955b5d2388c7a2b792721941d2c270eac5a
  • SHA512 a5eb2c410f8669bfb744158d459fe69221649d444394958774f2d91b7082c6537f798114ca51b395d7fe35db634cf41b86d6b7bb589ee17e0acd688bfea17ba3
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderfpdiloaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2