Extracted

• • Target
    416a1b448d92aaf4a73eb31cc458a068
  • Size 434KB
  • SHA256 774d7c77607bc7964f40cbe18a7d63c76524fe5af7f6ad09a68fead4c35e9cdb
  • MD5 416a1b448d92aaf4a73eb31cc458a068
  • SHA1 b5d3833863e9a47548e75bccbc4ac47498b3e650
  • SHA512 bacbe21970361976382b56b777309361df3fbca5e98ccefce712d964b13810e007777acd286c9f544fa7bcba82f4e3a06bb2626a399b966e75d018a7c1dd1fe4
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderpoubloaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2