Extracted

• • Target
    documents.exe
  • Size 433KB
  • SHA256 c9ae0452a8991f36ffa96fc5feb054fd33c04cc77c58113eb8bd69adc50fb539
  • MD5 07c74a1b268774fd0cb71822edb1bd16
  • SHA1 87690dbfb006919a0e36c8dda7a7b1347b24a03b
  • SHA512 a5e78baca11d4e21cc7d59389700d60fe5907fec130ff0e2d5fcd86be53fffc95c29d43eb265eadcf75a3db2b26fca51b21e519390f1ec57c8f161cf5b01526a
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloader3e9rloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2