Extracted

• • Target
    Page-1029382393.exe
  • Size 480KB
  • SHA256 547b0c2f7b3ee0275ff34781d0fa579a07d437629c9ee5e81d8782bb7e12dc4e
  • MD5 2d6983ca4172cd59f90949443d4b5596
  • SHA1 06ec7184a82223036b85743cdf988f2166fbb4c7
  • SHA512 541fc96ee9d4727a2c0980c8553a54285cc511cf3298d5ca07f53340a0e2da493324aead0035433b9bf4fc31cb646de7127921f02e4a4fb334dfc87999859024
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderc6siloaderratsuricatapersistence

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2