Extracted

• • Target
    17dff4dec1eeac82d1b7e96d284c2c50
  • Size 239KB
  • SHA256 5cef577cfd13f14d2c7468515dcd2da6bdbcbfe9e6778bf2dbf4ee212f273372
  • MD5 17dff4dec1eeac82d1b7e96d284c2c50
  • SHA1 b282b03a103a8f159446f85e2d372ddbb35d73a8
  • SHA512 5ae6ee97f7d9b0414db3dfbcf638a8bc160bc0202203cbdc9db7b08280d4226a775153de18e8ec1ffdbefb21e8361de9677ae826957b6c12a80ce42b2875f8bb
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderud5floaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2