Extracted

• • Target
    cotización_1782902.exe
  • Size 498KB
  • SHA256 a6900f47fa0f0d76b67e1c4fe017dad2665e52185327c9bbd905514cbcf7728c
  • MD5 60cb897960cc1e4a74cde6395e74dbfe
  • SHA1 18a97dfd7176f8f07334d2f3836f1226f2220a4a
  • SHA512 11fe445244943a3b588817369f0adf7aaa03f4a592c68eb604679c8f77ca44f9af786570d06180b87f67284effe29d695c3585ac83b34a1eaaa97a02e395c34c
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadersnjqloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2