Extracted

• • Target
    SWIFT COPY.exe
  • Size 521KB
  • SHA256 4eac3744a1240baa0ba6a519876425b8c52ddaefcb6e65afe077d71b1393ae52
  • MD5 a1e4e121c1bf7157a4b99f5f47492c80
  • SHA1 a689e4386bc380ffbacef832f49d7984bb2d19c9
  • SHA512 56e02018651381daa382af3cd226e09960a1732c3461e4dde6d2deefe4cb001ea87396d5981d20c697c1708bc683efb019a8fc2fd1133dbe661714ee22c6989f
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadersuedloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2