Extracted

• • Target
    Confirmation Transfer Ref_MT103_0023456891099200.exe
  • Size 1.6MB
  • SHA256 c97f3c263a8cf99b9535d4cb5276eaab9e07fca8c51ac010d5fbfbad6fc5261d
  • MD5 0560b3530342bf45528a88bb8d760db6
  • SHA1 24dd619febf36dd1816770675decb254a351e081
  • SHA512 c44ed3629d79a8afb9253ffa10baf225836fc547843817ca678aa16966f11a3cb3d6526403c7e29f1d21c288fd05c954392a539c8887928e72684413538e85d9
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderu2poloaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2