Extracted

• • Target
    PI.exe
  • Size 696KB
  • SHA256 ce60e4de64afb14f5f5db72f72dcb978930c13b743f093bc8562468c7680d9ee
  • MD5 ef9ddc4ebd697d61db488c560d2115e9
  • SHA1 a60fa983cf0a54caa2001f86bac961bba4e4ecc6
  • SHA512 c2564963ca294f5b6ccccc9ae1ae7c325cc981d0b225345b6aab72e1bb100f96606a46fab18f488d3d8eac98a814960c61f3d64986e9a422d3e2c7d6f7667aa9
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderk59hloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2