Extracted

• • Target
    jzFbN3X6HH4H0YC.exe
  • Size 832KB
  • SHA256 9b4ea9f90dc0bd79331fb576e8e11bfcd1aaca5d89eed706bba28e23d81819e6
  • MD5 d261ff3ddf608797f8007f534d089590
  • SHA1 12d139a8cad257fe8da2cd6a0e41a702b364d1e4
  • SHA512 fc5d5a0d7986ac26461a7c34d5d70b5dbda258fd34c24fe277d2ec4fbe604c8bbd5d0e633a177392299ccbbedca405882a02f5bf1f89ae40baec0c813561d8f6
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderrmpcloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2