Extracted

• • Target
    Swift Copy.exe
  • Size 1.9MB
  • SHA256 f1943befafa73351b7dad586f7ff686f2c099a5ebbbdb63bc4f16d67024fb17f
  • MD5 fbf14925b8537f4321806d6281916815
  • SHA1 9cc38d660480f9ebbb25779ebe8fbc88cf358c8c
  • SHA512 9ca48029b50c8632c12bdf651697ee3e21b309bb2267beb80fc39d22f29848a761de1b6e85985c66978e5f21e4dc39eacb5a9e39b8d14433aa60c1e081c6ccc2
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderb0arloaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2