Extracted

• • Target
    aaaaa.exe
  • Size 1.0MB
  • SHA256 6171e04c14e21039e5d518ea5b1129a09ac09d23f8c8169da89ba5fc7e816a35
  • MD5 0f5764c57c3af017b048608730e0402c
  • SHA1 a14d94994176f88afadaed4ec22a666ce608a251
  • SHA512 422d7b836c78412ec6e4f6522111100dfc9f70b9dc497f84f05eece55f4c4d885ae5b04d99715c52833983ba75291ee31caaacccef8e6df0defe0e57a3cafb63
  • MD5 SHA1 SHA512

  Score

  10^/10

  persistencexloaderseicloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2