Extracted

• • Target
    MT103_Ref001293838 Confirmation transfer Copy.exe
  • Size 76KB
  • SHA256 ed02c3de60701f97271c578756211131d9d5e7bc141e77f97abfbe9d64ccc92b
  • MD5 6c0c7c7b6bb4b7beb0fd2e834f34db5d
  • SHA1 4fbd9569327fd153021dba6bcac1ce4751a92405
  • SHA512 a07820d5e460979be1316eeac1f7635b197f04f4f638ad8dbfa81dcb309765f162f542bf0ef07a0be9985f590b4879e281254be03a78379d84a5e696f2949d16
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderarnaloaderpersistenceratspywarestealersuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2