Extracted

• • Target
    zzHNEqn2w8nxgjh.exe
  • Size 750KB
  • SHA256 358769e50fdda092bbae4944f6c3a3db3cde967af3936c4dca22dc578727447d
  • MD5 512da1515457c223a346dd4f2ebbc041
  • SHA1 ed75fcded3cc904d99014a39cc652819a16c2283
  • SHA512 4f58dc842ff740936394a0ed240eaa0c537dfbd865945d686a133b963a40fe5381c59b0cc49a42ce35c52f24ab5860550feebca0ad61d732f05c26d7a7b87d47
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderqg2uloaderratspywarestealersuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader Payload

    rat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2