Extracted

• • Target
    TT_copy.exe
  • Size 514KB
  • SHA256 fa41d632cd7c8ed80982c6cfa90e964e086ec9c0c78344e76f8f62d9343941d9
  • MD5 b6485accc7bee4c3a9a4301fe59d2c2a
  • SHA1 745a25578da05808886836cbabffacb820779493
  • SHA512 caa333f8e62d3e61f49f4146922cc511cb3c60a3645c4f757f572df41cb1b399c1f0bf904761ba8186ea23c0da7f0ec8fc9f7407af5234b72274865ccb7bb003
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderioxfloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2