Extracted

• • Target
    Invoice request.exe
  • Size 807KB
  • SHA256 894cebc6da151cbe64ab4094b2e779f433dc0865ba1cff8063747ca407454629
  • MD5 a5ffb999f20c34fbfb66b7adb4d79150
  • SHA1 d0306b0ee9bf0d23609868c12257df1053aaad82
  • SHA512 58479022567b5c163a433b5b02706638624df1e6c42974a14cca74c1bb9eda924ca70c75d7a24ba6d20f2ccd9e066ec62e882d7954987b916e7a091f51305388
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderm4roloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2