Extracted

• • Target
    5daed332426c66a3852518126bc49dfe
  • Size 317KB
  • SHA256 12fd506bab09a036a69b32535df6392d533a5ad8112c8b7bf287647f8c032bb0
  • MD5 5daed332426c66a3852518126bc49dfe
  • SHA1 1669f6cebdc4daae7f7f7391bb62ac74bad5ef00
  • SHA512 b2f579dd70b88b33ff9d594f6e15ff9a883464d7244f78f98651bede4a70edc1fe240c3766e38e6e9237ffcb853f22efc427cfb3fe30e93a863ca0ee7ffa19e8
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderocgrloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Suspicious use of SetThreadContext

  behavioral1behavioral2