Extracted

• • Target
    xwpwCCbOtiF8wAO.exe
  • Size 835KB
  • SHA256 bc5116cdc710b153d2c32a9ecb5bccd7f3ed3c4cee398b9eba9f482dc5c77cd1
  • MD5 a31c8afe0addfaa127801da6728a9e07
  • SHA1 da0c7c87fbd6f45ed57c664cbcd2e1ed25f1e35a
  • SHA512 de3141a6ba8468a2436905123899a58b3195a921397e09ed4da176e3845028f13b9bc1d5f58c22d1c61870e25e1d48e26a416829c01ed7d298544594f721e6aa
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderiqofloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2