Extracted

• • Target
    Swift_USD25,511.exe
  • Size 522KB
  • SHA256 b8d8a8ab682956d7abd31c4fa49690ece5f9349ea7753e83243ef5a933df4684
  • MD5 dd39c893cd30479da89bddd36b0c198d
  • SHA1 9c5414dc87b86ad12e5700fd084fdec97fe07028
  • SHA512 db5623a5ca31456a63197e487c766e414cc596458a4509c07c6b45b6d22dcf6e97ea9b373d62481b7e329736c92222dd8a4e03121ac2e93cbbf5e3ba941bb836
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadermwfcloaderratsuricataformbookpersistencespywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2