Extracted

• • Target
    bis.exe.vir
  • Size 451KB
  • SHA256 a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448
  • MD5 9e1bb80ff1f6f5181ed26c62ef3de29d
  • SHA1 5c37096275b5947dfd68ccacc92eec204fa73883
  • SHA512 f1493090882bbe106508b50a0dcc8ac9966b157837f3d3d428b5b1977bcda3ea00eb067b5f925add5a38e069cfb4e7ce63be49ba8db29b23eb171290226e7004
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderrb1kloaderpersistenceratsuricataspywarestealer

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2