Extracted

• • Target
    c0259d2d7810f13988bc017910508927
  • Size 537KB
  • SHA256 e473eec04a43a280723367337e0ff1083ed5f7dea858173dff9ff4c6c8a89029
  • MD5 c0259d2d7810f13988bc017910508927
  • SHA1 67385b86a1745c813e00ecb5460da37472aedd96
  • SHA512 ba736c5ac9c844fcb5ff988a1dce53c5db8897dcbaa1ea8b5d9f04f06f464b680f3b847e8b47036ef347211af54ea540b042cb30dc733cd8461c65d39d300d11
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaders2q8loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2