Extracted

• • Target
    scan097890.exe
  • Size 247KB
  • SHA256 67bf345a4ea3e03b4b58a7d9e47f9d31a93f79fefe4e69067ee6c15250930169
  • MD5 0b062066664a14caee56e7b3a88a6b7a
  • SHA1 f868e9b32ab782d657cf7ad156174a75e23093ce
  • SHA512 792895f03b5a5955eaba91581977af76edf92ae074f2e7cac0c0e1e125b62803611852d215fa8b5c6074040a09f9bdc0f36ecf4c707c94fda35e7bc211817049
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloader3a4hloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2