Extracted

• • Target
    vsl_rfq01209800122.exe
  • Size 249KB
  • SHA256 fd86ed836eaae451df45e757be525d3c9260d72e0c8af2eb85f1832a8499eac1
  • MD5 c348f7fa655d92a8af86e74aa75821e6
  • SHA1 3b9a060bb64b880595287fcc300d4b5513acb879
  • SHA512 65b4275494e326fa96b9e89e95c9688097eaddde8af4b57cbe01471f01986239fc314b914952286d0e1fe9543f93c44964e9191cc95bea7b345be606862495b4
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderigwaloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2