Extracted

• • Target
    PO#1018476502.exe
  • Size 936KB
  • SHA256 9e767c4f489eeeed91e9d2febf8640f875211857ddc4406cab4c7b5ddda084a7
  • MD5 2df2943d2555e151a22e99646969996b
  • SHA1 eb1c3be2846b854164712285e6c2d494de8b2f1a
  • SHA512 9735e328c26ece23977cd23fef2207fd897a5b6f4cfa739926c8d235bb21f203a39bf10af8601b933bd5c66e2fa36967eeb39dedf86f3a8d675091d6b05dcb7e
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadere0eploaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2