Extracted

• • Target
    Unpaid invoice.exe
  • Size 450KB
  • SHA256 1bbc8a34b7590c1593c5a79a8d0f93b17a162f44893c37aa11e4cb9e0e2d96bf
  • MD5 98d2d5ac3bd493d77f0a7300a43d045b
  • SHA1 7fdd3b9b76f2c40df10def7ec3aa25c4fb192ec7
  • SHA512 32b7aa0518d6b41864d0f6f90d397cd377244b8f6af07178252aeb5b7ecf57e347c2aa2a3a4d94327d799bfcf8fe87b5c8164b0102c64258fd55a4c024ad0ef3
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderb2c0loaderpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2