Extracted

• • Target
    QUOTATION REQUEST DOCUMENTS - GOTO TRADING.exe
  • Size 651KB
  • SHA256 e5a0ede7fa969afb1b610eb91c97c19a7a3ff52544198d1d1714bf34c7db8a7e
  • MD5 9c35649333b05a64d1056d21c7194454
  • SHA1 cb72007bc2277b6785978d52ae809bc7fba47454
  • SHA512 20d54bfe5f1aef1de2042b899ac6ecabc4c35aa6203b3ad3380392154e58d74024919c4347d6af106e19b002018f987263febf394402d01a013bb6c10b11bb1a
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderbus9loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2