Extracted

• • Target
    Urgent Purchase Order MAR22_76543.exe
  • Size 991KB
  • SHA256 bc7cf974c3cfb35a9e7f4abff78a9c68ae6a9ecb2eb78725adfd3ef6db6d6e0a
  • MD5 6cbcba435153e29981f263698dae8331
  • SHA1 6755ad827614b5b63ea7bbbc88c834df898b1b4a
  • SHA512 c8b2047276b346e91c49cc8cb265226978facfe24aa31fed50ef5eb6f51d00ff19a756545d9f47419d10bf64add77e32a9e670a21e69d97dd3dfb7fd394466bd
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderahgeloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2