Extracted

• • Target
    Purchase Order no. 005404.exe
  • Size 467KB
  • SHA256 69c77fdb89867a4004fcfc8de12e3ea749456ecd8e7cd9a3e316e9b7d5093f48
  • MD5 bb0491e02280f165e6672a2d3593f63c
  • SHA1 2b69b32cff02e0ba618d001e5860f8e9af21d146
  • SHA512 be2b2070716c583e8f8ebad5ad26a901de10c4a21b628f0b604ede4501f89d8ffbb9d8beea957b827432f3268ed20bcc5b42cb87b023e79cf5026faa6e4519da
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaders9neloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2