Extracted

• • Target
    Nueva orden de compra.exe
  • Size 790KB
  • SHA256 a6a14f198c4aecd3c93a2e2dbecefb7f56643c231fc6eb685c5006eb825c591d
  • MD5 8a0c8617916a78bed4855f857bdf6bf3
  • SHA1 676478452d9c755b8b40032bba876a465afa2779
  • SHA512 37ce13d1d1cd514d67101b1dcb08884c9684a8e3cee0b932c2ce6fbd75c5c7e76141c71094be3af5d87be97bc95a29c70727d8e8b9873132f4e9c9653f262d0c
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderpvxzloaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2