Extracted

• • Target
    REQUEST FOR QUOTATION.exe
  • Size 481KB
  • SHA256 84bbdc0b303d03c1ef4ee6d48dedd94181d8fc5650a20b557a555b0917aaf879
  • MD5 1fc0c2e7e6b8420483111ce7d0be97be
  • SHA1 dfd4391cb69b4ae27b7b2a7d78e79272e69e24d4
  • SHA512 69d3a17a7454300b3d5256fd02b6cd562d64ebde2a8a9b1e1e961afb2d7e7e1fa2378d2b8ddbdc9e8cab476744b5d14b26cd4d58f03aa539b12c6deba633c663
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderp0seloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2