Extracted

• • Target
    SOA.exe
  • Size 1.1MB
  • SHA256 db33772c98a3b201320bf4b88830aa7ec9e2c85797cf4460ab67f8d4d93964f4
  • MD5 7760a3d9ef17a66544149d4564afb06b
  • SHA1 5778fd582c9eb9d511d522246aba0c3ca6a769bd
  • SHA512 a5b92fa61be0479789566a08c94aa9e6d4f03c5ea17f06215585d031b5c967d97721d7d96ed607a855c1f3a2e6e0ba5b54af8b1e5ba97de40b31179ac99a3912
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderbp39loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2