Extracted

• • Target
    HQgXCXtgTPoqbNO.exe1
  • Size 660KB
  • SHA256 ce43600b741bcb0a016975e4e276cc89c9553efd2cf65359d3cc5f0b24415f81
  • MD5 3a3c8b654a047127c3106a5520ba8636
  • SHA1 fba378d8c5e2bc216e507f347bb552322c048bf8
  • SHA512 db0516064275d73afac4f666aec738822e3eeb4a6d3367a92d6de5d748c7b871e0ae099ca1aa44d2cea8b81d1d4b31e705975c7f4854992e86919e7e1f467c58
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderqg2uloaderratsuricataspywarestealer

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader payload

    rat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2