Extracted

• • Target
    5c46bfec3ed39ea08feb47002eb83b38.exe
  • Size 637KB
  • SHA256 7052f92dce4eaee0a7a7046c6529d6ebc79ddb2ee6e487cf34c6c7cd5dfea6ee
  • MD5 5c46bfec3ed39ea08feb47002eb83b38
  • SHA1 340e0f16322bc4b0d49bed3900398eaac65d1590
  • SHA512 6b89463aaca430019f832dc6437619337b146ac79f67011b39f35a882904b3613bce0aa95ae836663f14a1f9fc3bc2daf82ea707f4b25c7ee5d8830ccf8b3179
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderevasionloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Xloader Payload

    rat

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2