Extracted

• • Target
    CTM REQUEST.exe
  • Size 265KB
  • SHA256 01222693e4698149f19d31ac66567a9815f89509bac13d690de8a5afda2bee08
  • MD5 64477dc3ce0b183b116147707d6f6928
  • SHA1 a2859ec6076ff22a0a45a20c056be9d380cb5c54
  • SHA512 9de95fb485a2dd4554a88cf78faeb5e01bd9073632322804403ab61cde027739750c28a3a036228cbb2f8a432017a0dfd09a3e4cf5dc5da2f7273437be402699
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloader3a4hloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2