Extracted

• • Target

    953708e0cefbd35c124e526d9f7bd4d2

  • Size

    706KB

  • MD5

    953708e0cefbd35c124e526d9f7bd4d2

  • SHA1

    5c3437b790aaca62b048c38f53584aedb6aaa118

  • SHA256

    5598831a8a17b53751f4c34112c7c4b42d4906a6e73d60018ae8d499ce605580

  • SHA512

    1b21b714b95ae43200b652178a99b815ac6f95a3e411497cf21592e3ecb788fe8e813a5d55299c044a3ec6ad362e584cce132801efcc2c64cc85324636969960

  Score

  10^/10

  formbookxloadervfm2loaderpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2