Extracted

• • Target
    QUOTE REQUES__PDF_________________________________.EXE
  • Size 515KB
  • SHA256 db93a8cf5c8b72db62392b79b6d89f329801525af7a07e920505068922d00cc3
  • MD5 c09c8c0f060b5c6e10947578a3993dfc
  • SHA1 7a86e892c6be37749a343a7a3013b6a4f46ac988
  • SHA512 ff3850186ed4b3536ff5bc8c0b1dc9b4073957aa7ec2b03049a783ffbdb63bfe4a481918902d345ec26b02527cfca1a26f3df7c32fb95334bbdd9caf870c8af0
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderihg0loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2