Extracted

• • Target
    Quote order#098799.exe
  • Size 760KB
  • SHA256 1e3d099137ab4d4c152e6605801b6a5ead9837cb142dca1f5e596b75181cb673
  • MD5 b60ac40065a55d8b26ca658aa8ca494a
  • SHA1 fafe3588c3cb155014d3654dd872ea6f34785b44
  • SHA512 9397c5980c04dc61b595d973cb6660ad1f1881bd3a6bb29bade10a715fe3c2efdf3b2181602231e435f13fee9c830f2917399dcf3aae34759f54d7de073350f6
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderm4roloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2