Extracted

• • Target
    4400820_AL TUWAIJRI.exe
  • Size 528KB
  • SHA256 261bc200d0f8ea4598b2f907283268c101b8e8dff6e0604627ba0e98c94d075e
  • MD5 e9bf6f679d853cb6bffe070cb2e8e1ca
  • SHA1 64f6284590c627427c674606e75227302b609154
  • SHA512 9ec9f2068958d80d9551f6930cd96e5aea7b02c6683f579f1fc61e9b6d43921d299f427f29fc2802814e9a4f4566f3bce0772a62d2a4f61f4d72f810408ae415
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloadera6hsloaderpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2