Extracted

• • Target
    New purchase Order.exe
  • Size 889KB
  • SHA256 65d63079af57f5ae33cb341bc94f3882d2516efc82a0373775c564759aeb862e
  • MD5 69f2093d0e8722210b96012212776ece
  • SHA1 910fc996781777fe1fce27b115914e6f82097391
  • SHA512 a05aa45f224b03a849bc488677fd79b8b251880c154bb9c0f9ab58de5deccf785b121f8f35ddd175329de09ac1d1e4add884203c71e6c4f62b470a075f578d47
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadera8hqloaderpersistenceratsuricataspywarestealer

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2