Extracted

• • Target
    inchna.exe
  • Size 491KB
  • SHA256 88d97538adda1f29e2f088883d64db0776c2f7e9c80a2a789785c4af970ec129
  • MD5 5813409d72e5b6ac2ec5caff138e2abd
  • SHA1 edaaf0a471315319396afcc4dc14baf5856d7a3d
  • SHA512 ce26f504bdb71bbecc878066ffb5b79e965b7ed5d7ccd98594eedfc9af857083961f444ef4fdd5c95be3c57d4227c5ac297918e4f91dda5242357691f97e9bf5
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadern6i5loaderratsuricataformbookpersistencespywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2