Extracted

• • Target
    Lista de orden.exe
  • Size 1.0MB
  • SHA256 10b8fbcea2f59c78bdbf498297dbbe4c8156f80b371bf1bee8cedd196e911d27
  • MD5 5f68159b2aba817d7780bf74a3c9de0a
  • SHA1 8ac0b3dca1f456cec554e34319971c11998af2d5
  • SHA512 8231db07e1bb2a3a7a2c603a8ce4631aa02c4066fd3b9d8803449bbdedfd3e46c2636f5df9707a94e53d0b3488ec09b4effe1805f6eea516c52d1c7ffece0bce
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadereuv4loaderpersistenceratsuricataspywarestealer

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2