Extracted

• • Target
    1e40c98d3677061af5e7d6737f6ba86f
  • Size 1007KB
  • SHA256 ca77df966e202e0eab6d3c2280f95fb59aee28b5e9e540be3dca1d66c46bf2af
  • MD5 1e40c98d3677061af5e7d6737f6ba86f
  • SHA1 0d800c1d6788eaafa5d581b7937315ffaee11bf1
  • SHA512 797490b3b68a8b46dbbbb939a27dcea6b3d26a74497b9b2a3d35b189192504b5488d4408c4f5e1c1eb1e614446781eb13e5d8f468e1446a010e54944764cdfaf
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadervfm2loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2