Extracted

• • Target
    SNO22 595406_RACX-159814.exe
  • Size 740KB
  • SHA256 58fb47124bf49f4190852baec863af03f73216cbba65c7eaa527f6ec6612e42b
  • MD5 57d59a3b3d87c9e5808da7ad2b013955
  • SHA1 22a3f4dceee7b5f63e9e940a435412362f947878
  • SHA512 63b009c902adb07e83d9e28917e1f3ee5a4a49ae426ca4b99a29eeaa961c56e1456fceb02f078578f37a271e98276249ba182686bfdca60053cc8bef08802125
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderp8celoaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2