Extracted

• • Target
    6dd83e20f43a9bd2e136fcd77131f7e4.exe
  • Size 473KB
  • SHA256 5babb878615fbf3b56008f4d7becccdb0a316e3eecb95ce99ea2a6c9d5a8a19a
  • MD5 6dd83e20f43a9bd2e136fcd77131f7e4
  • SHA1 2d816c160bba20f5e3989af02985118e42a4fe70
  • SHA512 4f485cce03cd198389906fe21ffed00982408c9f8d688af6ef1067d3959e4df96d4bb08f53244d32d571b5735b4957c3e35156081b68495922b95bb5ca1b9b33
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderevasionloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Xloader Payload

    rat

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2