Extracted

• • Target
    QUOTATION.exe
  • Size 657KB
  • SHA256 c48012dda89b9227c82c4523aa0b1b5045ecd2fef0c98189c6150cafaaf6d9cd
  • MD5 e2fc9733bfef32c56458bdb83d6ba654
  • SHA1 b7b88d24d8c951eebf795410c7adcb3dec703c58
  • SHA512 d4e1188e5de40e78feff4ebe363b1ea1e3406aa4cfdc0529de6fadf78404d0e80c1535c13497661135105772d57c9bf6ef72cba3ad1e14a77eaa401bb5f02819
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderbqt25loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2