Extracted

• • Target
    SOA.exe
  • Size 258KB
  • SHA256 d9cee5cc1ff9b14e0c1604dfded72f085e39b1983c41b595660a60bfaab942b9
  • MD5 9d806c39777c5c9fda47905df48b8851
  • SHA1 01bf9dbf205e2197f67d7a5b2eaf60f20d6785a1
  • SHA512 0370634be0031d3b74bfdd772353d71afbdb5bfb7b8c4cba2bf34c355b6850202fb7f69c92ec6d625e18332effdad794a249ce89e71980908f0cd4c890311460
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderb2c0loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2