Extracted

• • Target
    STATEMENT OF ACCOUNT (2).exe
  • Size 867KB
  • SHA256 4860d96e25e9ffa5a288ee4ab81dbda67a521786b2abd2b7a91a3b37e863fe58
  • MD5 289cbbecf6a93c1f75688b3ca14a8730
  • SHA1 2f99dab38f9c11889505c519492c9101d15eadf1
  • SHA512 0510024d17f82ca8eb677b0c4e624edecd2c6c152e73c50a99eea9a587988a26e5aaa25b1e6b89ef832c7f0d47524f93ae9925f6e620e0ea22016da512b7b258
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderoogiloaderpersistencerat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2