Extracted

• • Target
    vbc.exe
  • Size 515KB
  • SHA256 7bfabb3e53f70e2ad39155a8af8d7e27a07ec01b0ba8faed52cb569e4f78142f
  • MD5 a8538dba14e963ac7894257f7466bc06
  • SHA1 d5de28b9a2f41519f8ae6fc2be6f9ee75569e192
  • SHA512 04da55fb7dcd87538e284a929b79427bf72241fea7a291f3650853442f889cf21de0352f7a381bae316df852f3b0ea87e5eb9ce8e3e509a27ab34da0b78030ba
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderea0rloaderpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2