Extracted

• • Target
    Prince_Silvero_S.A.00023121.exe
  • Size 260KB
  • SHA256 a4b5237de09448f0adfe3cf6838fad36eaaeb192634bf0ea71bd525699c02dff
  • MD5 43c6e39b238fd77c8bfb7f3178b47ebc
  • SHA1 2dcb9511d7912aa203d42adee4e91f61951ca832
  • SHA512 2af5eac1b07cce31ec458ee3951a9e827f89f68ba491e73670d45e68ade07d7f8e7997b71bc09ca40aa7183c5f51b063537490ea7b52696debc2bead4dd4c0cc
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderdgt9loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2