Extracted

• • Target
    RFQ-576476566_0986666.exe
  • Size 416KB
  • SHA256 dac74494f01d415ffd11b8d9dfc13b8910fd731ec1d2351d2c5115228d252cf0
  • MD5 3877030d64a737d072cd2aa352144262
  • SHA1 a8feccdb2027578b76124779f751e809b0768fa7
  • SHA512 811e22fa6902fa354411594703b3ba210672e0e64deb545f8e43f26eb06217ff3d044bfcc86bb2b661aea6fbcaeae013cc6e3ebc1759ecdec1e74fa60fee300c
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderb5celoaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2