Extracted

• • Target

    vbc.exektfpmhuf

  • Size

    790KB

  • MD5

    14f5bfcb44b9511f2cfac6f29ab55898

  • SHA1

    f8dd1f7ec5259168dc98367c3eaa998f08b41a9d

  • SHA256

    8ba3166fa29eedff427b62c2d1b05984949a1ac87a34ffa2ab95f4404e96d0e7

  • SHA512

    0bd4db6d4f45a58b25445726956876d5546bcf73436b0b7c0411ef3d0e683fd91707551a146e775482399896ea6581caaa3d57d3e966a17a451315dcdf1f3b02

  Score

  10^/10

  xloaderarh2evasionloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Xloader Payload

    rat

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Uses the VBS compiler for execution

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2