Extracted

• • Target
    January - February Wholesale & Supply RFQ-Selections Items_202112_13.exe
  • Size 510KB
  • SHA256 dccfc975065a099ebeef539e8b55204c0bb0f234113b8b4dec6ce830b829ae68
  • MD5 bf15d17b336bbed465648db314e9be96
  • SHA1 0a58b60e269b65813eaf85f708b5b3cc57fef636
  • SHA512 045ef52543c459985228bfb833a47ddac6af2fd56c0e00d7c8db8656cb7ba4885a4e0137be951542b6305c6df7986846f14934dcf509bb457f6da07854535410
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderbnq2loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2