Extracted

• • Target
    berthing.exe
  • Size 245KB
  • SHA256 40fbb07da69abd2e9af76579e314905103c73059c02b77c74adf81ab97eaa099
  • MD5 af8e2192f8e67182761b3e533d017af7
  • SHA1 e9a55a5e8cc2cdc571b965f0719a9e92bd749f21
  • SHA512 fca4e22f5969a725edaa378ff2d2bc3f83da73fc6c79259f5de15f39bb111f45440e54b352a3a6d2cd69f3a3d04b504c0ca9651108af3c2e9a83e83b60317aba
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderbs8floaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2