Extracted

• • Target
    newest payment.exe
  • Size 1.0MB
  • SHA256 805a169b8f08ee6d903d5ea86178a1e50e65ae3c51a91085227b0e77c04efbea
  • MD5 b4b1cf97819486dbd0c0c0e0f38baf5c
  • SHA1 901248bad47c7e4d39252aa9b95a32459100ec89
  • SHA512 bd634196b966f0b35455280d7b67aac6516ecd1877fbd2c1c61451f4713141c19531635947abe8bbc5bb8da3d40691b8dca618fd2ee7df653504befb0e22de4c
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderu55jloaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2