Extracted

• • Target

    REMITTANCE ADVICE [REF0000360261]_PDF.xlsx

  • Size

    2.3MB

  • MD5

    43b96385258acf475e9bcfa298296114

  • SHA1

    94a26c83395d7e51fd9e8d5b5842708d96b4b9df

  • SHA256

    136adc85cb6e108bb2b15af54afdce83ee2affad76c0a669c7c8e9ff10dc86aa

  • SHA512

    53087749e9b6eda791a66e1ceea94ed5375ab816b839ef0460c37be4e16a98d86e2452853862d727a340096855a89d3b17d8dc5ccc2482f5fadae363006c7b47

  Score

  10^/10

  formbookxloaderloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2