Extracted

• • Target
    PAYMENT COPY.exe
  • Size 1.0MB
  • SHA256 0035f11e3163f3a2dd3d94c08beefc7d1c2fa17abc210526ddc336bbc8d10d0d
  • MD5 7fc3d6e636f997e52658d3e0eab9c9b0
  • SHA1 9822bf40113a5b53a0abc3abbdaff97a3d2f4154
  • SHA512 1b555744d7219e148737c5fbd0e97e4f220469fbbe0435ed74aac9eb078ad72f21c1647b46118baea60e7c224150ea77333696fc69573cde92a397d73d579538
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderok4eloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2