Extracted

• • Target
    RFQ#220128.exe
  • Size 749KB
  • SHA256 beccec456cf3e74a220ae1c8fa65cc0f4ddef57bee5d4f2ec71ad7b99da52369
  • MD5 6d236070946d1a500d0ce9988240975f
  • SHA1 94ada5c3577d58390b252353f3ec9a7fcca49c35
  • SHA512 362e149560e26131d6d00daf1ba7a8bf6f156990bbbb90d8eb3d1a2249277288d109d388046d5cfbc816cd05aaec02d8729d636b340c4ff7f934543b62ba27db
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaders9neloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2