Extracted

• • Target

    836390a3bb832e2b10fb7bf5ee0d88e7aa32179839e65b933ff2da2aabce8f89.xlsx

  • Size

    2.1MB

  • MD5

    c30d91c05ecd94de4ee314be1f27bf22

  • SHA1

    fed9790f0ebc832445b34ef1caabe137ed15e3ce

  • SHA256

    836390a3bb832e2b10fb7bf5ee0d88e7aa32179839e65b933ff2da2aabce8f89

  • SHA512

    0053323cf2d7fada473a23ddaffd7be38f3015613f651c15bc10d524db3a656c7ed20d522feb9a7f3183efeb3588d53865a3a9d259c7707ce1dbbf2d2981fcfb

  Score

  10^/10

  formbookxloaderloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2