Extracted

• • Target
    IMG100897 TWI-SHA 202102 BANK SHEETS.exe
  • Size 774KB
  • SHA256 700c8d2a1ebc0994ccd09f93acadb4806ed3554cdef24c8e9ef0b3801646bbde
  • MD5 46bf448f0f13973dca9b0818f23fbdcb
  • SHA1 83e78c785903a560b44bd419f5a2e74266a98eab
  • SHA512 84570ab18ce5c42bfc3f266432043f64730b14611e5d5d2b246bbe4d528abedb704a173dcd3f69c50a3e7cd767eb5fdba8db5d289312b6e1da00b5b1ea60895a
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderepnsloaderpersistenceratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2