Extracted

• • Target
    fe6c034412fb96a3d6e8f1c2d636041f
  • Size 1002KB
  • SHA256 a7017af2c60c1c5bc06d07f88e12d3b471a8787e233969d92ac6048d303cd682
  • MD5 fe6c034412fb96a3d6e8f1c2d636041f
  • SHA1 a4654c204c066fd580377e76b587346f1301391b
  • SHA512 17a87114b344a3c3ecbd8ded6866c0ba3ae58709507052146b3a3de8db7bc35239f32e61a11f549e839468ba247b0b78d500cebf047de1b0f0b48c8f37fe728d
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderfu6bloaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2