Extracted

• • Target
    Swift Copy. txt.exe
  • Size 692KB
  • SHA256 d9fbe8e59e8dcf5231168ed35a3ad0c8c448eb888eca02c9b898d5961899e839
  • MD5 b7373ce13b2172f88e17b873d585390c
  • SHA1 f250238d78386cdc379ca3281dfef2f40b0259fd
  • SHA512 229266a8cd4de5fd13fd3d7cd05b0e6dbc474939582f76b8972800768b08eb569212b39d9446445da4fb9b89b0f7e14dfcfbebda5031c2d1c218a7cd480eece8
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadermwfcloaderratpersistence

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2