Extracted

• • Target
    9c57cf589c6ff051d2aec2bbaf515dfb.exe
  • Size 1.0MB
  • SHA256 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701
  • MD5 9c57cf589c6ff051d2aec2bbaf515dfb
  • SHA1 846b8e1244b7a7e2cbddbd837c77708b6bb0bb32
  • SHA512 2947df318501ce13e7b99cf65fc0f18db3086f6ac97727831ffdb253a28fdce3ce10d1d1998b80423d313ae5d375ad2f65ff9b3741774e2a3632de7862364a0e
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderarh2loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Suspicious use of SetThreadContext

  behavioral1behavioral2