Extracted

• • Target
    b1136341dce035655548d5c78daca86e
  • Size 384KB
  • SHA256 e4368355994cacf472d053ff31a672820b4a293b7f7cff9eb1347dbe5335c9d7
  • MD5 b1136341dce035655548d5c78daca86e
  • SHA1 1a834d12401aec960fa9300e825d4c0ba5c592b4
  • SHA512 73b10a94d962dbe4ea48babec9d26b470d9ef82443512a77a63cc5202fd0449c1ad76d69b100c5369b5041ac6444521cc559370798133721ff638078e0c153c6
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadermt88loaderpersistenceratspywarestealersuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader payload

    rat

  • Adds policy Run key to start application

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2