Extracted

• • Target
    tmp
  • Size 571KB
  • SHA256 f89fdaf70a745763294ddf8e9470b39a9575b5edb408fe40abc72531fdd89824
  • MD5 e593e143c9a594f4e78d7cd795e450be
  • SHA1 9db1e65209bc072374ac8d50c5ead94640dd559f
  • SHA512 8a2c2d640321ab4c92f8a8c05d770d7146bad7fa2ed8391ce61e52c326e49d5249060ceb5a5bbb0d6d975f8dc918eec4ba7de8aff6334d00f970e2634bbd3ea9
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderitq4loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2