Extracted

• • Target
    PO-28122021.exe
  • Size 506KB
  • SHA256 278ca7471b97ea8a649958dce92862dbb71659d1c89fa67a600cabb2e36daaff
  • MD5 7eb3bd5327d9fa689884629c9047e6fe
  • SHA1 7f9aee6c781e1c1a355e67ca04947d6d5697a84f
  • SHA512 839848c6299c2d35469dd3a0292f3b31a2a429b56069a699ceddd92106aa000c09caf979606485581cf5b5e1c0982c61e47d01b401f2ab5caafc37553cd7ac10
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderpt0eloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2