Extracted

• • Target
    96afca76795a349365f562c265220068.exe
  • Size 425KB
  • SHA256 032dfad6230e8c5eb84d6225d3766cc849ae5b920fb62b2f24cb33896d94d465
  • MD5 96afca76795a349365f562c265220068
  • SHA1 a37fa0252d6cadd31c73bbdc2be7ddc027f7a2bd
  • SHA512 75db0878f41f8e86b7476ee972e89b0dfdf97cbe0e562f7c7f2b81a24a01716bab4a06cfdb536cbc9782f5daf01eae8d3d158edf276dd1d7951e879abfae11a3
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaders2q8loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2