Extracted

• • Target
    Purchase Order # 1014397-18NA.exe
  • Size 742KB
  • SHA256 8c6441d2f5e108a63524430674b8f711cc7b218a2a06fa2c43e24b1de1d76088
  • MD5 f2ad6cf09ec9872ba9180e069aadbfbd
  • SHA1 6bc55e609f4d66d20ad190408d854a015f1d7aa6
  • SHA512 7ec82724492371ab403a590de31aa17731febcd919066526fc7f5a268d50ff024a13c73b69cbf084d674394a10f7f52eb059b72d6a0ed806affcd00e7a89e274
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadera6hsloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2