Extracted

• • Target
    vbc.exe
  • Size 313KB
  • SHA256 79e8144ee4e2e97695849928e162288fc282de48ff4caea48314f9cb56477917
  • MD5 da75710d466d2544bc8f4442b1ce57eb
  • SHA1 8356ff061e4864bfe114fb9e65bed20c267c78e3
  • SHA512 6d5c8f28f60bd494cade7bf4324c3309ac29a421202dae3494b8118ade429560e4062a2c83bacbfea46c63fe173bc04ffc299b8dcd2f611d67c45e7cf2c22695
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderciazloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2