Extracted

• • Target
    Swift $21,500.exe
  • Size 715KB
  • SHA256 b5821114ae6e03e71fa7cc2dc293aa7f8a5563ebb4a2151194b2acb9eed4758d
  • MD5 2e18224bfc26fb56e53d8094e1560d83
  • SHA1 cfa9b5961c4103610dc8a45b58da436c55766552
  • SHA512 8d28d7646bb08333d190244c9f6e9768d86872a0634c5bd41ff670152756f686b8cafbf3636aa76a298c99d60c9eabe393fad1eefe3d157cbce7f269ec1b5b6f
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadersseeloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2