Extracted

• • Target

    tmp

  • Size

    510KB

  • MD5

    ed110000e4a38ea4c524a777c0b28a38

  • SHA1

    a82ea598a09bf51269131363d2ca1120e45c92aa

  • SHA256

    33804adf1254ef1376ce4a0416ff03db837b5bf23a752b8483ffdc1738a5cb59

  • SHA512

    b771cae1b0e7a25d58dbbdb60a86d39bed08d6c0f97d18b928cb1179dba6911f494b4cec853d169d3113f2a7afa1c3ac45e6fb74f6c6a1fa73978b9209c0de4e

  Score

  10^/10

  xloaderwfc6loaderratsuricataspywarestealer

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2