Extracted

• • Target
    Lista de orden.exe
  • Size 1.0MB
  • SHA256 955e25e69ec794dcd2a45b79f3eeecf71c734eb675e8a3e14691bbc8fbca5f52
  • MD5 bbf255febb7c99d6f235fd55c91757a0
  • SHA1 850c355f476950735135f0ddab531a533c377a11
  • SHA512 9f41e876a78ebc7729f3606d9251707901a443e1c5a90540951b849b1202a97d341796cf93579bde1cd443dcbbad1d2547c769ce60acb62c4fd508816592284e
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadereuv4loaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2