Extracted

• • Target
    USD 12,371.35 SWIFT report.exe
  • Size 740KB
  • SHA256 047ca53bf616a52ba6946c0a6cf6676a3030b0baf6d987b6268203caebd87b74
  • MD5 064a51fe70b2fe972c704f8d9a5e9a3d
  • SHA1 c3623078edc8673f2337e840869b02cfed3d64e2
  • SHA512 2f7d07d8cb0965e160d6d5a6ded896e0042c8f06d61a080108813740cf56580eae55245c89d48a1f5dc551d416f3d0969d5c6a50f7126436cf3f9406773b7924
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderloaderpersistenceratmodiloadertrojan

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2