Extracted

• • Target
    quote your best selling price.exe
  • Size 773KB
  • SHA256 fb98f0f50c30ffdacfa3ea67a2990fa5ec2ee2646dc2226179f8589aec41f5d1
  • MD5 b5ea3b19f5ad0419edce1aeeba786d21
  • SHA1 cdca00e205a342ade90bd7d13acb88d66948ac14
  • SHA512 638568231a244f5fb2af662ef2b52ee2deee094adab7d60bd0dfe3a0cc9a438e993ad13e6f24501d48ec4e4c01b03b0e7357ca3563a16b66eb3a7159c9bc4247
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderdnqiloaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2