Extracted

• • Target
    8c6d84464096e6d1849c689708516a8d.exe
  • Size 385KB
  • SHA256 6370ffa17cea91839f8a40555da2ef41f0e97d539e4bdc60871a7783abcdd7f6
  • MD5 8c6d84464096e6d1849c689708516a8d
  • SHA1 8be47c3512da862eacddc5f4e1eddc55d0e8d4bb
  • SHA512 02913ecf4ab9927c86efb3add83a9edf21de2269acc49b698296626242d5aa04cd89eb8ac267ddafac82d39a2fa099e7474cd70f13f22ab324d1c54f14fbe967
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderahc8loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2