Extracted

• • Target

    TW0091.xlsx

  • Size

    187KB

  • MD5

    41521b74c54998dcd1460d444b07c5f1

  • SHA1

    29dcf07f9964a0c2a36defa2935441f559fe7cd2

  • SHA256

    91cf449506a9c3ade639027f6a38e99ee22d9cc7c2a1c4bc42fc8047185b8918

  • SHA512

    8841ddad3690fb1c1436331b03ac26a356f0ff32ab5df923770da4af94785ee5d73cf0f68367cdb2bd3c31922f8be8726004e737753b11c9b32959f71155466d

  Score

  10^/10

  formbookxloaderb80iloaderpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2