Extracted

• • Target
    invoice.exe
  • Size 237KB
  • SHA256 0d9d4d0dab7e4cdeb774f8dd43ba226e01e88dd8072927b288db367d8d22faca
  • MD5 17bf2fbaac80e74e652a4eb1adc31ab0
  • SHA1 61b90dfd4a23e14db551f709c5c8178a4a2bae6a
  • SHA512 e93e7d05c7642afb0c7121b31051975b7070bc386f935fb3ec959674422caa01325382c29fd793c42f593dc56b5d744d20c007b57ae4d2e405aefad13f050c27
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadern6i5loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2