Extracted

• • Target
    NEW ORDER.exe
  • Size 535KB
  • SHA256 00027d11309d55312ae77f32d4ae79671c91f541e577bace7a5a5abde05563ad
  • MD5 6878e9896fdd84dcc11c997c9b7330ba
  • SHA1 2e586f8db46953532b5e25e07add4dbaeea83a79
  • SHA512 ee2429ffc0962743827d781f0d1e45eced4222a0667d1781b3ac50e3100d00cd5ddd350da17a44d96dcd73f4fdce619286534326b8cfb0dbbfb064cb65f8523a
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadersuedloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2