Extracted

• • Target

    tmp

  • Size

    446KB

  • MD5

    71895780eaa4fe577e5d406cb84e150e

  • SHA1

    e798fb18a9ddf2510cdbc536dd96144661ca8ea8

  • SHA256

    c43a9d3d87d5ce17e61de74587b9a1e4aa0250aae1fa6dde4e392e6de187b096

  • SHA512

    d78eeff6df29a1f3a6e2366746fbbf1fa58595ed3ddbf491d9e5bdb34aa060306b219c916ff4e39bb3c35a6a9f4700753515067d531bcc774f5303fa6b1ed3fd

  Score

  10^/10

  xloadera2c8loaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2