Extracted

• • Target
    Payment Slip00425.exe
  • Size 396KB
  • SHA256 b1bfbde2135326041c2ca0c01f6cd3295d90fbfbfb2be8bf78c659ddd071e853
  • MD5 fc111634e7b6e48d0e0140f37ed1b97f
  • SHA1 958749f0ac8518bd9f09c1be0f196aeb72c2a974
  • SHA512 0edf5f675e6f7939737789c756482b392196c1deeb8fb44620a47bf9ff6f3a333e8ac118a4c50d565ddba9a83c4d0874a2f6627873d996da75c954f5807799e8
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderloaderransomwareratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2