Extracted

• • Target
    kk.exe
  • Size 241KB
  • SHA256 ca5e82085e4621747c2ffd1de555b0cdc47cac5934575ed3de39c3b7095e0421
  • MD5 8191878054ebbaf4005866f45927bf08
  • SHA1 218f9946c84751db608882a7cae6465952cbc68b
  • SHA512 6f6c99b0e82973ec52fb47a1efb4b571478d695b66b607a9cdf2e4508382d5947dc237b9e36025070af9b011fe77ae2872c6561fbd093352d8ddd695ed6de7e2
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderiqofloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2