Extracted

• • Target
    triage_dropped_file
  • Size 265KB
  • SHA256 dbc4b30858a2fa9f7001f2347e1cb88f660b8e6651962519b78a7978c6cc2d72
  • MD5 7d9ab9e5573aa8fd5402c3d023a8fb19
  • SHA1 fded1868cef4f373e59db3a74e79b801afee8156
  • SHA512 ea5b596b80f5afdc7da4103ea989f98d7eef19aa302614d262cb33e9aad0e784c66c91c3b822095b9b5180a8746435543eb9b6de74fe1bdc3c3302658a78429a
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderb0usloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2