Extracted

• • Target
    PO 47295 y 47296.exe
  • Size 1.1MB
  • SHA256 190b1831c5dfcd818fb3a4ff19a5a0ebfdaec9598e71c7a8c9f56f6ac9e52c6f
  • MD5 31e1ce8d6f9e718f346f0159d5d5a1a3
  • SHA1 ac8f7a8314f05f26c4273f224eb23cc20a3e8889
  • SHA512 82ee629bc0a88c109d6b27a209e8bf99f1476819336dfa6df7a7083c4595627003daba03fb6d34aaa7d43ac4fe3fe5014e52798236c553b75eae167e6ce59926
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderw0celoaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2