Extracted

• • Target
    PQR-365.HESS - CABLES GLAND FOR INFILL (D1-10).exe
  • Size 354KB
  • SHA256 2ecba366860a44b8d6e0fa4e238d02ca9728e77a2ecd6ddda25a29c8c1a9cabf
  • MD5 e77af7566ec0c796d1c2bfd0e551daf5
  • SHA1 2debdc43a3c0bd4df7b94421a8e023cea0e355d4
  • SHA512 116ba78c01926efea7950eaec7b9611fb36e0339a22cb786b5e63c4485960466b172a239819930be4e059d34b3d1ab1aac3f9f58f4c6895b216b81238cecb69a
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaders6aploaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2