Extracted

• • Target

    Payment list.xlsx

  • Size

    2.4MB

  • MD5

    8a23d4ef9ec8eaab5ac7ac876a397bcf

  • SHA1

    51dc094299003c3c3aa98fe44aea5293d89523c7

  • SHA256

    76dd7546076f7061bd2ea4221f164904d2265bffe3a9360207f16724dbb18ace

  • SHA512

    06b4b2f76f86ce2c91d2c163b9c910d4040aa23d1ea07942ec791c093b23fbaa0b9ca5067a51a1ed2dd6745bd1f358102bdeea668d54df899ce79bcc723a1b85

  Score

  10^/10

  formbookxloaderloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2