Extracted

• • Target

    SWIFT k.bin

  • Size

    1015KB

  • MD5

    74edec99d7bf3b8c7d97d0a4d4d29b64

  • SHA1

    444e8af17aafc45430e7051126480d60dfa47966

  • SHA256

    0403e4b3772f23e41ccdde464fd1bfcedd517bd3c87f3f7652b2c55aee755376

  • SHA512

    c374c62e51109ece72910644f4ac8094defdfbea3c8c456bc2983d55f692c6f0542593f4f00db434a660bbfe3fda0c52251ee0cb82ed6aa5209f10e4cbf42b08

  • SSDEEP

    24576:fqeXxJ/Fl1+LZVCS+9ESK0NRmyMUfus6suP:jXxJ/Fl1+tGXNRLrP6f

  Score

  10^/10

  xloaderi6rodiscoveryevasionexecutionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Xloader payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2