Extracted

• • Target
    657573-ordin.exe
  • Size 1.5MB
  • SHA256 73ef486f00e7b911bc1101d2e0eb3f8a23daf374a09dfdd81f03ccfae5106a29
  • MD5 da88332ead90a88c4ee6522641021a72
  • SHA1 5ed3fde91756120597f86aeaab0a587d03a27762
  • SHA512 6cd0ffde70ff27a6a485b24087d8becee951846890bc875e99007cad1227f94de43e4e6405ef88dc37e77c95c7a4d583102a9602fc108749291f23a59b991aa7
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloader6f3oloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2