Extracted

• • Target

    cotización_1782902.exe

  • Size

    498KB

  • MD5

    60cb897960cc1e4a74cde6395e74dbfe

  • SHA1

    18a97dfd7176f8f07334d2f3836f1226f2220a4a

  • SHA256

    a6900f47fa0f0d76b67e1c4fe017dad2665e52185327c9bbd905514cbcf7728c

  • SHA512

    11fe445244943a3b588817369f0adf7aaa03f4a592c68eb604679c8f77ca44f9af786570d06180b87f67284effe29d695c3585ac83b34a1eaaa97a02e395c34c

  Score

  10^/10

  xloadersnjqloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2