Extracted

• • Target
    doc#0210903000.exe
  • Size 256KB
  • SHA256 5852e0b1479d914e16a2f1cf21d61ff4e1f3d35b6fa5dbcf0055cfc2c9a89936
  • MD5 9b8f96489ef491a4378ae2552ee9950f
  • SHA1 276b5857cd4b0b4289660efa6751821df93f374f
  • SHA512 7bd616157ae2c8021434937438fbcff60c139aafbb31f8c9b431925ecc2543af16216236557ba32360c784a6a65ef86f1e59b5a2fba47602035b9569731eac9a
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderycndloaderpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2