Extracted

• • Target
    reg.exe
  • Size 421KB
  • SHA256 4dbb7c1c75a4553436b03d96efcb5aa20c7c3668cfd6a50cb2c08fff92d5f499
  • MD5 6054a52000e12227158d5da6410896c5
  • SHA1 91b7c607dcac68260ca4175d21372796614269d5
  • SHA512 291c418844648231b70e9886563e7d44d1ae9427b16adadee7004a0a121dfe73610fbc9a53dbf7e266b8a2809ced38fff7071403dba18790f05031bddcf864ae
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadermwevloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2