Extracted

• • Target

    ada88465652140cfa9ae8955370fc40f

  • Size

    656KB

  • MD5

    ada88465652140cfa9ae8955370fc40f

  • SHA1

    e13c0564f3662230c11537366d1568c5c3825513

  • SHA256

    6e6e18a85c523bfffd1b5293b978832f7387fda9b9eee87d3d8e98666fe020c9

  • SHA512

    2e288e1d465c0babe87f52417dea9822dafe0aa21448468c2a38c1d72e9b933ed38b06a1cb1a0ea34ac9100b8faa9603117f01697c22c0ab25156787cb8ca51f

  Score

  10^/10

  xloaderw6otloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2