Extracted

• • Target
    dwg.exe
  • Size 96KB
  • SHA256 6f33f5e3a23420dacdc26fb8e2eef07fe482e634d4b832b0917cbe7ed37864f5
  • MD5 6a9035b7435c6aa9e6c8e31cf771e316
  • SHA1 16a6d2ac44b8ac3cbe112916d8cd9912d3f0dbf7
  • SHA512 bc77de47966c4efff0220fbac4ce74051d76b283eac0d2c7ebeeadb680cccbc96bc303ed6df3606c87071a87854c1fcbf2b2dd5eeb5909ce83600dce8643fc04
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2