Extracted

• • Target
    DBS_Swift $12,863.exe
  • Size 344KB
  • SHA256 def69bd673ae57b70c20087596b787eb27c1f0da7053ba2991e87cf7f032c43c
  • MD5 9aad1149c17535bf37fe98c564958ef6
  • SHA1 47e9710ccdef23f1b45dcc2d459148461359462a
  • SHA512 44a8dc3abd400c2a5ce04717a14fd349a1b6a55ad4da9d1c218d31cb15acbcde714a05084b8416e6e3b2eeb09f1614185b18bfd08d308b1cdbc27ed8507d0d55
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadersseeloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2