Extracted

• • Target
    order request.exe
  • Size 563KB
  • SHA256 d368e6da00a94aa2a44145cde60d85f8b29cf8634893769f243f503524e24043
  • MD5 fae7b5f628a7c1642f1d22bc4dde9369
  • SHA1 cae7c670a8def01cbb693f972174a8489a0ee2bc
  • SHA512 51aa5c7e886419f970259268aec5201c81fad9fbc3780192c60111745ab6807f1fe8940d80abca985c03ce434c92458b38489eaf1a1620f9eacec33153e7af9f
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaders9neloaderratsuricatapersistence

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2