Extracted

• • Target
    1d4dad86bbdac5cf52abafa6170a66c4
  • Size 282KB
  • SHA256 4e586d008dc06d3c77d590393b4e565273b30ef2b536a193976c9a82353878bf
  • MD5 1d4dad86bbdac5cf52abafa6170a66c4
  • SHA1 3f439bef91c21086aa0551d82f0b8d8601072243
  • SHA512 2209ae9061b49c53d279bcd0d2d6a8ad487476111ceb0abebd5284e8d5e58dfbc4a7d7311669c87d8941c32a46ca971602cb6a517b3f19d2e39a916d8ecbf8a4
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadermt88loaderratpersistencespywarestealersuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2