Extracted

• • Target
    Neue Produktanfrage bestellen.exe
  • Size 694KB
  • SHA256 0e4db1ff40da83dd1ec6e134dfd86864f24df29bbc9065158e395cbd63436493
  • MD5 3e13c1307ffe6a5fb784019f1d171f65
  • SHA1 cd1b8be69b7493311e55038ce7da232471257a78
  • SHA512 2ec8cd8e2c26299b6bf89726931e2c775803e3718b79df40ac58198119f3fc87ee16361ab8de42fa2c32b0ee036989bc8701708905950a60d33ab8c5d5c42bbb
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderceahloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2