Extracted

• • Target
    TW0091.xlsx
  • Size 187KB
  • SHA256 91cf449506a9c3ade639027f6a38e99ee22d9cc7c2a1c4bc42fc8047185b8918
  • MD5 41521b74c54998dcd1460d444b07c5f1
  • SHA1 29dcf07f9964a0c2a36defa2935441f559fe7cd2
  • SHA512 8841ddad3690fb1c1436331b03ac26a356f0ff32ab5df923770da4af94785ee5d73cf0f68367cdb2bd3c31922f8be8726004e737753b11c9b32959f71155466d
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderb80iloaderpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2