Extracted

• • Target
    7952b7a232367ee80e7c1f20c2051b35
  • Size 244KB
  • SHA256 1c67eb0637866fef3d52fa28ffaedb9869c7f92560a58db83f1d0bc27cc8df1f
  • MD5 7952b7a232367ee80e7c1f20c2051b35
  • SHA1 fea3ae9ecf2d69b53f46ca823240b39b5c721c43
  • SHA512 54b932b2b2317b3fd8ad378488eee8a4971402adc57605f95a220466af2d1676073960f79fc9a4f1185be63abd329238fe07855d8706aafea54e4f22d2a1ec21
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderw6otloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2