Extracted

• • Target
    b50c8d52a000d981d40fab8469f67e62
  • Size 191KB
  • SHA256 99f7e07f84e40e362b58d7b84110898eda66ce1e6906b2e27f1e9a9cae90e548
  • MD5 b50c8d52a000d981d40fab8469f67e62
  • SHA1 dbc28aa27dae6704d3344b0fc685cf9afab70067
  • SHA512 4ffcc3d37521bc21d537c20cdf2479ebae9a657565f6e416fdf63c947c768998a1865bad8ab79bbe7ecfc54898498b7808e8c95f4212e7f49b80add33ce43d59
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderhsotloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2