Extracted

• • Target
    Confirmarea comenzii.exe
  • Size 986KB
  • SHA256 be910ed7df930a3d74f01ac74e72f8c3ed89d791f29b731cb2076d632b6ce9cd
  • MD5 a5da56a201f38ffb86844a993a723650
  • SHA1 c56dbd64dbfdc0b4997fc004efb9b3270c2c2696
  • SHA512 231965a2ff4fbe24968ed8df7beaefc30042be868e7e546a5cc884141ef16861570b8fb8cea6356e50af1037227594f85b9b64f86d3d1c154ea2e14747a237f9
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadereuv4loaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2