Extracted

• • Target
    48dd5584cf3d6c0930f09e335d98d4fd
  • Size 294KB
  • SHA256 22d5552fed81b606509972d3c12830cd2cfcd77ec68a8791706099e97b2c1bad
  • MD5 48dd5584cf3d6c0930f09e335d98d4fd
  • SHA1 a072e576904888726dda9ad1c61673492cd72eae
  • SHA512 95492bb4e2a9f51f5ff547d2b7e534787cac49d7004a146bdf3df01d7f22f478a7f89f19f1fb411487d8b58b153223e093db44fc6441696091302459d6c3b9e9
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadert9hhloaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2