Extracted

• • Target

    _MVSEASEAL_RFQ_.xlsx

  • Size

    2.3MB

  • MD5

    266dcfcd2e08490c31848f65b2278422

  • SHA1

    7e61b82d9be715199e14c1fea4e264e68cedcb8e

  • SHA256

    3be0adb00e31207de79f54ce067a7f815519945357e03ba87fca258dacdbc364

  • SHA512

    b9a873ce9d95af8a8ff095d8c51e967d948b6eb60a2585189d4f2c87a8d1f72f6524989e19a65d5270a384baa598948b96914fcc57aa7898dea802cf46c6d203

  Score

  10^/10

  formbookxloaderloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2