Extracted

• • Target
    KONUgynwW37Tb1K.exe
  • Size 398KB
  • SHA256 425f5003a91d1ecced29d4e5a5746806d0b7d5d4a3833c13b88677a3c27eb0de
  • MD5 bb040b47d2f6f564bb5fdb59ff610ced
  • SHA1 ff31a2d5284d43b4f2ffd27594bddf8352db3149
  • SHA512 c91949fea00e5cdddbee1daf914b1806f2b458a3bde2842f90d0f43d4e3247b952f8780443c4cce50c4c42c07ec32b4f514c87b427eca3a323087556b2eb7721
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadercbgoloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2