Extracted

• • Target
    OszQV1HEQJLo5FM.exe
  • Size 714KB
  • SHA256 05b6c2741d33e6b3a06eb63ddfb99d41f35463761a1d36fef5b408c36bf45637
  • MD5 d3a7d68573e550afef3c0b778c9050a2
  • SHA1 4a22ffa4793333ed8e286272aa9907bf1d5537b8
  • SHA512 053770ec7007db9507e1f610d87849a2a3cbf0e1978befe599793deb7d0583c59e293b411156df5cf746a02cf7d07ed2dd6a6bc1679a9f01dd54608d89786cd8
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadericunloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2