Extracted

• • Target
    YRS1504720.exe
  • Size 878KB
  • SHA256 b0689ba526627ae1cefce61dde4198b704f4ce53f898e1222f6ce40b73bd391c
  • MD5 73aaabd4d5155a4ed6a37c6c33a21602
  • SHA1 ef08b0d3e5429b93c2496747c5163fc55044adbe
  • SHA512 1732e3d6b606b99187f1f17d171f05ef99b808e111b752ccc9453c3d851ef187b7e7a61fb23905233f31c05f8146285deddcab5588502a5b6071af1a39938f14
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderahc8loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2