Extracted

• • Target
    RFQ.exe
  • Size 381KB
  • SHA256 d4524304e059a341b36dfff67ecfde1832142373d0728956fd8efb079440035f
  • MD5 65383c8ddea3200bf69bcc4acfc5522b
  • SHA1 b4f22b474c796fe40bb08787ebb2a5e503e6936c
  • SHA512 fd1742d44a5137e9b21e45edc2715c5acfed2596cc32eec5bcf361fb2ecfc8dadd7a2c9519727a3772a32c6a5e30399eabcb62150253a136be4c8f8471cb7d9f
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderoms5loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2