Extracted

• • Target
    Halkbank_Ekstre_20211102_082357_541079.exe
  • Size 918KB
  • SHA256 a5f047cd5a1f181b220f8a68e01f7003c3f81d5b6601a4578977b89cf4ea5246
  • MD5 b0b90e5693e10c3fe1f3e051d6771800
  • SHA1 8c01847f9d4d8714f5ad80cfb785929899817e67
  • SHA512 aaf87df6fd6faf8c677a11a8db6514b44acd8bd8074f456a0cc74987b71429c4f6a6702fa4bb068250fa83f0979eec53fc8a729c3a3d373b993701075990d370
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadern5fqloaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2