Extracted

• • Target
    PO 42746 VINNIC.exe
  • Size 831KB
  • SHA256 c7c0d3e8cd6fb36ceb4b5c2e32b019dd209fdd38fdf1bcb215f973da80437dd8
  • MD5 813231c25eac4f49fa84a9fd2d8adfc3
  • SHA1 22ca3524bf3886a32101f5b7f7626747449ad970
  • SHA512 10b7ade3955804d2d29a943d614ae940dce8aec87495f170f342f4d64a19ae5b65ea8824f3afc6f26676804e12fb9907184b1213f198e4ca52c6bbb7d4fbbc15
  • MD5 SHA1 SHA512

  Score

  10^/10

  persistencexloaderk4cploaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2