Extracted

• • Target
    7900dcea134e84a16491a43722518b95.exe
  • Size 984KB
  • SHA256 c349c8a20c6576c397a5dff95fb121e7a16dfdd992e08694a4aacf387cf8c3e7
  • MD5 7900dcea134e84a16491a43722518b95
  • SHA1 4c904c97c6d806a86edebe06f0972a8f8d20d6d9
  • SHA512 099c086a8451d14df7f2fa9af3a953e5121e45206b8e0f4236414bd774db903763845072f80943fc43f269117a79c0363402114f5412402af74cad3b3ec840fe
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadervfm2loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Xloader Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2