Extracted

• • Target
    swift copy.exe
  • Size 334KB
  • SHA256 d559f37dbda95ac2f2e50388cae80a4ee30c81216b644f65ecf4c1ceb87a0b5a
  • MD5 0ef829a686321ba5925e0b32aa0a9b4c
  • SHA1 399430e2a2b8ae653ce94caf0cc1a628572a90b5
  • SHA512 937321c4aef380dd488b3a53a7dccdf84c37212e1fdee8cdb00c86d2f23bb6b5f0254948a8f4057f2d0d369600a4a451101c500a987f7692c4531842ddb90108
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadermub6loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2