Extracted

• • Target
    5ee1ef0817bb2681ca8322cc48568626.exe
  • Size 372KB
  • SHA256 daf64aefe626d474f355e5d42de574fd52bc7f8afe382dce0e174e1cf4b23bf1
  • MD5 5ee1ef0817bb2681ca8322cc48568626
  • SHA1 9411fdbfdea26e209a6d9ae10d667fe50cb339da
  • SHA512 14b7bdadf2ff42163a7b95897a2a0a23f16ce0a49088304a00c3075a20628067220a3472d705e5e886d16b0ab2fcf12d189914a425bb0cf419bbf328e6479c5b
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderasusloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2