Extracted

• • Target
    vbc.exe
  • Size 1.5MB
  • SHA256 bd7cddd657e0144076352a60664ca134c2ddee8ffe8da70793d5b97f17cf9318
  • MD5 eedae095d9ac37f07d6292ab10d3ee97
  • SHA1 4fef8e77f53fdf7ad4df70f3ef159a7ff9110ce8
  • SHA512 a53ebf660a1977713369de549cd1df538837837bf62f77079b9d57107359fc15339f2d7cd899b268a24683c0f45bac41d6b027756d7f3cd9d2abde8620becbd2
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderfqiqloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2