Extracted

• • Target
    DebitNote11_Owners Invoices.exe
  • Size 689KB
  • SHA256 691f4ceec58c748e1dd6535281cacf8dcb3f2f5907796dbeefec03c975dbb28e
  • MD5 ea8bb1ef138840f26fec47eef3574509
  • SHA1 6aa58e42cc0459bd73db0be275df61f329f1c4db
  • SHA512 1c0f87b2d3836f3c849bf16032da7d9bbe6c847511436d0f29d136a3af62e1c0b63272eaa3a5e7cb75413729ab91613f3bf126bd204e89dd1b951b0a35f5e4d6
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderloaderransomwareratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Deletes itself

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2