Extracted

• • Target
    remittance advice_001001098.exe
  • Size 331KB
  • SHA256 08ade6bd3efcd20c80defdde936ef1329713af42d28889ffb69ba26b321a297f
  • MD5 7877a7074c688baf439f7ec1ab150682
  • SHA1 6c2539fb927b57388866f1c072cdf681b585fb2a
  • SHA512 6e5dff775fe478634fc3553b0bed3e9e9fda7a956cc17743f2b1b27e06256008ba7bc229d55a409cb710f078c97b70bb709c764b9fc144c0700d77dab6f83402
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadere8ialoaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2