Extracted

• • Target
    Gv694Ht4iPIaqIv.exe
  • Size 797KB
  • SHA256 3554e8a6c968467f681a97f7d0af60e7be69d515ee9b093b8be749811ec99c0b
  • MD5 6cb30a9f9d530785abcd883a5462f62d
  • SHA1 70ff7701f5278d3ad314c7badbdc00f2f7bbd1b0
  • SHA512 6aeaef4a6939b331b5e846ad43e7c24a662a061e48c6b13477e804d9b7e94bd638cbf9f13fb5220a40e8d6dbd156b8de94da2ccd8f0eeb949ce86a470f463f32
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderwcurloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2