Extracted

• • Target
    522-763524116309-pdf.pif
  • Size 340KB
  • SHA256 f697de2afbf1f8c97d3947ee677e355a9f57576d64f1496e0e4560ccad4efdab
  • MD5 2ac522d691d5196deb9a915b63a3d519
  • SHA1 a7275a3851d663a45b4b65592778b420cd17f474
  • SHA512 3c4286abe950e67fc89715a822545047eb5441010cc8c9f6f5026ad1bffa9223192bad50c9e34d0385f65cf633374c4170d560e0a980a80fadcdd5f2544a586f
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloadernqs9loaderpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2