Extracted

• • Target
    Purchase_Order.exe
  • Size 888KB
  • SHA256 b15532a660090cc54e4f9f2be695da798d85a00a0aac366f1edfb665687048b8
  • MD5 25a4a2eed28102497ad0e0b3f22ed54c
  • SHA1 4523a4d509ea47d45bd14e7ca1d495463f8f8eb3
  • SHA512 bc1bc81a441b6cb91408c498f1ee109de376be53ffaecd023c2249411802233195fea4fbdb14742421989ccf9304b58a29011a02ad62c46549bed60bc06ca52e
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderct2tloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2