Extracted

• • Target
    QUOTATION.exe
  • Size 564KB
  • SHA256 33b08940d5a2fdd70c73fddf7e359193eb86a1d42e7cce27dba02718b7279c49
  • MD5 98baccb2a35dcd64991688d8c2f9863e
  • SHA1 2cf34e18ccb91d2e0572ec833f8656178f4e834b
  • SHA512 caf53ba7e93e0f781877cfc318b429dbec9490b443ff8e5533f5ef0c89a1f612ac6e7cc245c99b34ffbf4c9bad95c8e2a183e7faffba3ce78a8b23b1c4757e54
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadernt3floaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2