Extracted

• • Target
    c54d1466e897d1c09d1ef8cc0f2ced6b.exe
  • Size 192KB
  • SHA256 53f2b01b46fea6b60894eef19535ceb20e37f661839e607734c54ec5e3753200
  • MD5 c54d1466e897d1c09d1ef8cc0f2ced6b
  • SHA1 c8df71cc0ed01f9403f7bbcabc87f68b76290081
  • SHA512 626166b4bc2d3340dcc01ca014e959563f67ee3744cbf7aa7a540b61ba10d02d3e1e867ee9eafcf06de995199b709c19bd34c7c3529fa610adca205509e0d169
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderitq4loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2