Extracted

• • Target
    ORDER_80.PIF
  • Size 246KB
  • SHA256 2c9c53afeadf78570137cbee063eb4446a2f2086d516b348199ed4500434c126
  • MD5 e15ae6b598e9b227a07a09056570afd6
  • SHA1 46b5a6c316570f75be5f9732ece769547d431e39
  • SHA512 9648aaae24b7384a12b3c165591c781c375cec2af31afa60002060d9ba81e0f4d616d50ac1e10dedd6d7c363a56ccdceb29598aac517d7dd4341b24256b93ad1
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderuar3loaderpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2