Extracted

• • Target
    appraisal.exe
  • Size 353KB
  • SHA256 220ab940326b10e217ed23f4806edd06fac3cf52cbd3c8863863eac6893b02ea
  • MD5 d7fbaec1422aa58ccbce61274c369343
  • SHA1 8719753b80fb4cc585532a37f7e974bc0e1c91e5
  • SHA512 8efbf83841cd7283ae80212047166db6a13fe335de085839e4bbb593a22e90aec4690a9c5cd282b5fbdd3ae3c9dedcf88811af7d9f2730499427746bf758b622
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloader4qdcloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    property.exe
  • Size 715KB
  • SHA256 0ad637fd2f6be43b412315027c0e2636329b7da0f51a40e80e9ad8c76558bb6b
  • MD5 a7ce2f883660a89695ae17ce9c60a7dc
  • SHA1 d1d38d629f7d86d854efef65eb81635e4ab5d9f0
  • SHA512 b4158764b854f291e83bd47938b64e69029e63dc2f7bb96fc7ae11f3d9895109193e9ee0a2b2aee7d6d0b4022a38d2560cab4393609b58734326971cbd915031
  • MD5 SHA1 SHA512

  Score

  10^/10

  netwirebotnetratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Suspicious use of SetThreadContext

  behavioral3behavioral4