Extracted

• • Target
    21673a4749aeeabb4fa393b40b31f5c7
  • Size 308KB
  • SHA256 736e922d451686797ec76431a5c40aab65da4cc9de49fc8a898c013f44caf2ce
  • MD5 21673a4749aeeabb4fa393b40b31f5c7
  • SHA1 f146444b7ca15ad4c3efc01eca7503db4eb72519
  • SHA512 90317bb9d59d9362691db04b42480421b42dac9ca855fd0bf1d98f690a7e99e96f0ff8a9ede0fadcb9ee498c9a41bd7ff340af85c52afe7458c4b1b87f2f12f3
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadery329loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2