Extracted

• • Target
    Nuevo pedido _WJO-002.exe
  • Size 606KB
  • SHA256 b0c5c3efda2bcfa189ce5f5b94e1bf298eb712b0ad4e9573293a7883d54f4af9
  • MD5 73d92a5e3f3cc68f581431cda26ff26a
  • SHA1 a02d864f281eefb7cb67da411d43744000907c14
  • SHA512 d45fd79066ff3635fb5ce50f3009d82df98e5e03f0dca7205883bb5d67729bfde96beed4362a225573d03306bd06073629db37bfed3786e205df83e92a50ea83
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadervadqloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2