Extracted

• • Target
    quotation.exe
  • Size 929KB
  • SHA256 ea6d64bf5ed4a85b1fa7eee4d390fda3ace9be69dda2d4f41b92e5b40f639926
  • MD5 15fdd6d34a2ee6e971ba7363cab8452e
  • SHA1 c8dddc9e482a9ba9be76728b96fb225ae64fdb6a
  • SHA512 7b322c394486f91a0ffa1ce5c8578dab113278495a3d43d33cc9485d3a23c215b7705e4a55754d552e5935d8bd97d9c9c8dc975eab1c526007e55c80ba9e4b7c
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderingaloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2