Extracted

• • Target
    PO 270745.exe
  • Size 484KB
  • SHA256 87e35b392f0e6ba445a7b302b087c7c443d7188240b2efb742d01ab7a62534ed
  • MD5 a2a6f26ff8b334eaf7a462b0a67046a5
  • SHA1 dea5f21d627e422047bf7b6e529257f4d64a31f5
  • SHA512 b254ed614bc444a9d6c83a9721be241106225a750ebdff443170523ba1155f03be3563bd5075529fe69e4216c69df2a248fb46f72d486d4abd42a4e5f69e6e8f
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderimm8loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2