Extracted

• • Target
    db601737341d075854a7a92dcfe2c9f9.exe
  • Size 294KB
  • SHA256 76d07b33364445e08dd5306a4e98d34edb6895a8269e9bb5aa9ef80e1cb83b2e
  • MD5 db601737341d075854a7a92dcfe2c9f9
  • SHA1 16b3755c07814422eb01664b67370e31027c0f3d
  • SHA512 b76759f28bcb68453dc32384f8bed1db071642f4ce5d9c84b14f2b172937b9a62f6e55857b74e14ca6e4c2a0f20bc6a50ab0e37fa36e59b364bdd2b108799c80
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderb80iloaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2