Extracted

• • Target
    917479278d18fb239bb661f3960a821f
  • Size 265KB
  • SHA256 3bc7cbfbffcb2fe26936caceab37794a4c9b750d2afe9733d2885860d50727f1
  • MD5 917479278d18fb239bb661f3960a821f
  • SHA1 b85df90355ffd75a29855e4488e306433ee8e035
  • SHA512 c8eb6d79f58fb060d5c019bd73014297ae4fcb6cc3350a74f2bbc96e98d5cd049f3874b4c5d83950b02f9cb116caeaccb8499fc3c8c50a2f761803def2a24535
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderuar3loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2