Extracted

Extracted

• • Target
    PO2136634.xll
  • Size 1.4MB
  • SHA256 aa99576f50fbf176a2d463fa84591fb651c1751a344949a01b93fb8afa297b2d
  • MD5 d073a5ff90318913caf55a502993ec81
  • SHA1 aaa3cf3bde058e51cd07a0813c0809f4c2070cb6
  • SHA512 bb055f136240d23ac976ea9df31af5d72f062200843d1d3d764b4e73f6381290d5934aa6a7ee5eae3855659f71cb515210f3ad91fd8aee5f06cc223d392e234b
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadergdtnloaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2