Extracted

• • Target

    tmp

  • Size

    925KB

  • MD5

    4470f83cba058890c43ded4a3940c3dc

  • SHA1

    f9c2953280646715ec9ad0d034a6eae43d1fc8c4

  • SHA256

    0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56

  • SHA512

    8e3804af84b5f8d04630283dbc8764ea8d7395af635615013bf9bc25d3290c248a24e1b6f8486960aba5569c4cce105fb9f0ff82661d5f587ae56cab18b88981

  Score

  10^/10

  xloaderarh2loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2