Extracted

• • Target
    RFQ ZHANGHAOBO CO.,LTD.exe
  • Size 1.0MB
  • SHA256 d63af956dec05f8f8f440cc6feedb7d8045cbe0c2953eae0c9e612af8451c57c
  • MD5 8985a7f3ac0a252c443d06d5e07c89c3
  • SHA1 a853194afcd05e2a485bbe149e83fe716d72cbc3
  • SHA512 f4be4ac2ef2ea50589040ac1790dfa9bcc43217f850dd427e2021943fb511253e7137e3f1868daf34004e5759fd007b8e3fff9291e33ead26077042d7d3b66ba
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderiepwloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2