Extracted

• • Target
    Überarbeitete Rechnung Nr. 0047152.exe
  • Size 586KB
  • SHA256 bc1b641ded95e09ee28144b98ac38dd352f7a32ae47e9ccb1ea3a7f2e32372e3
  • MD5 140938bb2157abaefd647925dc569e13
  • SHA1 4aa1a9b9a8f6402778f703cee6eea8813d3af97e
  • SHA512 f8dc9a2b97053be55984b2bd7b4dda2b93de9ad39d14f3cf87e77489bbcd655ac59ffcfe9ad8a9854e9b0d044f35ab3a755a86c1b1fcc23e7d23d917cde2aba3
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderceahloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2