Extracted

• • Target
    vbc.exe
  • Size 953KB
  • SHA256 5683bdb2fc2b2f0bfd524ea328ead3cb7d405f888c54a96fe05dff6ee4d91bd7
  • MD5 6d656f77b56cafe4c1684261b99f2aaf
  • SHA1 bc8d6ab10897163ca494c29a752ea4d9b1bfe778
  • SHA512 c5ad1b62b71ba4f786b805f5167df5faba5b0328bda667bbe76bc66524d3a9283c1b587f8a43a9a46e83e4621406f5ce8ac4db779cb763b39526eb26c27af9ca
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadercxbzloaderratsuricatapersistence

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Sets service image path in registry

    persistence

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2