Extracted

• • Target
    New Order 000112221.exe
  • Size 349KB
  • SHA256 eae07efa1c1d3cf15b86b7d83258a0ec3bad96ec1bbdf0791b0b984a835387e2
  • MD5 b828ce355eb4606a72e32af06baf848e
  • SHA1 ef4268dcd817bab6175858ac97614857692b78ed
  • SHA512 bdc0e2451f4638ad93482d52b94b253c9033efc7027a6bbe945ea088045db5795a60464035d061d2e2f618808a7fe91ee70de72fa7ddae474fea45e9efe2ac15
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderng6cloaderratformbookpersistencespywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2