Extracted

• • Target

    triage_dropped_file

  • Size

    271KB

  • MD5

    f9a20cce97d6efd9e8d071420a8858b7

  • SHA1

    17680094e9bdefe2f5205729f2b55be2ffca81fa

  • SHA256

    aa9db27b2063f5aee9f97d7d86b883686f51bd030d0b38d6daaed3629a230a7d

  • SHA512

    fb9055d9f19788e0c2d25f3f400165b630ef6f62604d6ee6a764c7a57f5f115737db4187be30641bca16af11d84d3afdde73b0790f5d43f682e10439ed7a1026

  Score

  10^/10

  xloaderp00nloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2