Extracted

• • Target
    Order confirmation 64236000000025 26.01.2021.exe
  • Size 582KB
  • SHA256 238dd9cb9b1c235e2babbc3f3b1372da8d76e4d94a4440776814957e0fd09f0b
  • MD5 b18e939428b3ffc67c750e2a0988d61a
  • SHA1 405cc59b2da9a6187bd65e7c2fa4f9ebdae32111
  • SHA512 8b81ec5ec2276ec7ed82e6e696c33b73f416dea29781bab782930550144bde4f45d918514d80f242128848783b3acdeeeacb731504a7a20ee8793df84bfa93e6
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderloaderransomwareratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2