Extracted

• • Target
    fe19b1cca116f748b3f67788be824c73
  • Size 760KB
  • SHA256 988d086b6ca75da2fca905b090c6f20b21749335f7e2ee99d8dab2001d4667e3
  • MD5 fe19b1cca116f748b3f67788be824c73
  • SHA1 e58c2c38f33a515767bef275101290f29111713d
  • SHA512 a0d2132f860cadfa2e7f995ec336339fc883addee81122ff945e5044818386f8c0b88008116358b7e5e898b55e3a0a8fb30296e57b9e85764be2f4e811150261
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadere3rsloaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2