Extracted

• • Target
    836390a3bb832e2b10fb7bf5ee0d88e7aa32179839e65b933ff2da2aabce8f89.xlsx
  • Size 2.1MB
  • SHA256 836390a3bb832e2b10fb7bf5ee0d88e7aa32179839e65b933ff2da2aabce8f89
  • MD5 c30d91c05ecd94de4ee314be1f27bf22
  • SHA1 fed9790f0ebc832445b34ef1caabe137ed15e3ce
  • SHA512 0053323cf2d7fada473a23ddaffd7be38f3015613f651c15bc10d524db3a656c7ed20d522feb9a7f3183efeb3588d53865a3a9d259c7707ce1dbbf2d2981fcfb
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2