Extracted

• • Target
    e5b6a2312dd7aaa32ae7421f3874dfe5
  • Size 918KB
  • SHA256 fc987865d9443b0a2e9367d07da163a588ef2ec6cef5be08d1ef0bc10f58cd3d
  • MD5 e5b6a2312dd7aaa32ae7421f3874dfe5
  • SHA1 546ada15e1f4f7396b6b3c4563b394754bc55ecc
  • SHA512 a368d3fdbfee9068aa2546e67851b911dd426a9ced71ddf5c8a85c7033bc04cbfd80e045ab436e3e45c73e63e043f065bd1e6da8ecf93fad072cf43093725270
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderht08loaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2