Extracted

• • Target
    HIRE SOA NOV.exe
  • Size 257KB
  • SHA256 76302a45d9d14d54bcb9bf70fa034b385acbfbb11ee74c85556ddf12bd6ed4e4
  • MD5 02613bccf4de46abf744b4feeace4c39
  • SHA1 63b968acd9589b16aea484393ba7761a2208b289
  • SHA512 20baac1d831b844f427f6905c37fc7050ff473f789e918e63e9fc403f761ac3c92a5c1cfcb6cf2bf035123f710ec44d889ca9f6223c2aed669c232319ef32f42
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderi44qloaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2