Extracted

• • Target
    SecuriteInfo.com.UDS.Trojan-Spy.Win32.Noon.gen.25607.4305
  • Size 1.0MB
  • SHA256 df451e4553398ff8f82e6f516f7bd9b04fb8ea925612f2ab95b98284abb228f7
  • MD5 21433429f56b67ac47a1e4cf6cba4848
  • SHA1 14196178a1a4f991c43d5eb04d1b1f22a90d626b
  • SHA512 47d9dc6c03cd0e31df49542a390142402a92f4b36745828bbb36d4b5a59188d4e86f0ca121a9f510e050449067b7078af6781ad44ad8b14b1815692f7401c66f
  • MD5 SHA1 SHA512

  Score

  10^/10

  persistencexloaderarivloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2