Extracted

• • Target
    Payment Advice.exe
  • Size 410KB
  • SHA256 6d722da095632d50aa49b4749a4e7db323889aee6fad1ecc2c5dd999e63c645e
  • MD5 4eef207f1adff1af6aeee132213dd72b
  • SHA1 a2ba1855bc571a0dbdcc70b85f850c56299cd2e9
  • SHA512 3ef67f7ca60b253d01a88838bb6084d1bf5ac604b71b05a23aa76fa4e47d486ae948eb6480b5fb514fadd19a8fa63df271e07eb9b86e412279bf2a449ba9f735
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderic0eloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2