Extracted

• • Target
    networksec.exe.vir
  • Size 467KB
  • SHA256 25773608894ed7dced5dd50dc02483ffdd6d9ee3d79333aa8292c5d2a2586e21
  • MD5 0a7ee72e2b57214272b36a91835ece31
  • SHA1 4f8ba6b8eee9c2f612cd046b34905cd110ec1b12
  • SHA512 22d253e97694d8c62bd188c3ce9008445b3e41389672049ff8d768746fff3fba20a5025ca535b804a9bf976435cb7836e8d728009327c55ada359d2ee35c9f5b
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadera2esloaderpersistenceratsuricataspywarestealer

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2