Extracted

• • Target
    COURT ORDER # S12GF803 zip.exe
  • Size 509KB
  • SHA256 9723d45f7d2f12bde692d804c9a7bebd2bb1f9142f7f3efadff7c4a87bc33841
  • MD5 9e0776cf65d4c8f8f4df423e9996f394
  • SHA1 b4529219b4be129a9c5134c8204d81b7a309d9d1
  • SHA512 c22ee533c9fc788eb754440159f991a86f03936f5c607d012ebf21fd109fab21c3924679a61f007ed39b9ec678b7f0687002c6591c8a435571e710e4b25fa47e
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderu86gloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2