Extracted

• • Target
    vbc.exe
  • Size 991KB
  • SHA256 d91d04a052c74e24823eeeeec79d14cf3a5bcdd50ca4867d0cffd5a6188085d7
  • MD5 8640d5837c0fdbdc8a4b6966da2848ca
  • SHA1 0d619c30d819564ec1f32cac2dfabd3c772f4802
  • SHA512 545ae80bfbfc2b2ca7bcb84f805091e10ddc1374102ba6bc7b9988cd8358fbaeafb06fed1d8e5eaf538825532e40ec146001008bc71b28d20af2771c5ccf43a7
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderapjuevasionloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Xloader Payload

    rat

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Uses the VBS compiler for execution

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2