Extracted

• • Target
    ea0a94617548200ae45ca29bf84a0985.exe
  • Size 563KB
  • SHA256 68bdffe460b6b63619a94c667eed5e81ec779aa96edc78ecfdc7bd232ff37e98
  • MD5 ea0a94617548200ae45ca29bf84a0985
  • SHA1 45fe6c72d7d48a896a5b3940620c0f616d54c0aa
  • SHA512 3b59226bcc0f1e90af66cc8fac1a2214832b9a3fb1f50b469f46bf93f76de3401b4129bbca09f3e7d20e2d0ffcf5bcae2a22799cf995b102949868f79eb7cddb
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderc0a7loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2