Extracted

• • Target
    ORDER_96.PIF
  • Size 292KB
  • SHA256 e9fe0fe5cd5d59f973f1ea299c3476fbbd9e6a95f44509854286f584a313837c
  • MD5 d279a9125327264ffc89fb5cb4d8e433
  • SHA1 44ec118059baa04d7f812ed30f52b15aa138b181
  • SHA512 eb7d2a41cb461af28f961f4ae903d56bf730f3307e2bab1e91ac7e4b1b7ab6289f00ee2463f8d2477b9ffaba6e2667ff424628cf2dbc92a88716da98cd9c2db2
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderuar3loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2