Extracted

• • Target
    INVOICE_0097WE8.exe
  • Size 794KB
  • SHA256 555948e64ed4825dea5e57865e80d764aab3dbf4b973a223f7590ee9b72d23f5
  • MD5 b854d01747abc6ce5af8d14c9aaf5d15
  • SHA1 2383fdf2826e5b4b75cefc0b0ae767ec831840be
  • SHA512 6136a6b560ff5cef18e5f7d3963b16a44e5a1c949f683adac2eb6d2cfd44b47a103e5baa3b19645c0bbb933fc24a4437916655bd7e45fbe6f25e52bdff5bed68
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderrmpcloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2