Extracted

• • Target
    Purchase Order121.exe
  • Size 1.2MB
  • SHA256 8fb9ddc78aef013fcbc8ff38135972fdacf66a871cc4b42f719efefe2255219f
  • MD5 2a78112aebaebff9cf4b798e4587ced3
  • SHA1 72341b0916d6cb32faf91a9194932952e70f85b4
  • SHA512 75b1a2d67f5839133893e058fa00e79c46271c2a3a8d1b7516dde5b9dfc58ac54520024d0ea6b1e5be6f571ace8d79afd7c10633cde7495ddfcd45207a0792d9
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderjuytloaderpersistenceratspywarestealersuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader Payload

    rat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2