Extracted

• • Target

    f5G3iGDs25iJjZE.exe

  • Size

    1.1MB

  • MD5

    33899614b3fe24bc02dfb4c1f84dabdc

  • SHA1

    8dbc988c06f51cce14e4cc95717241fb1521fac6

  • SHA256

    b36891ab4a7fa6be1680a65614dd5551a3fa8a89052c381a954601eedd82e62c

  • SHA512

    30058e2e8d6da6b5e0db01cdab70cfb9af8bfb93aed69a009cdba0f1be4c9b805472a531a5abd4dc56f46349ff43a6ce797e98123898719a38e5329920aac5ad

  Score

  10^/10

  xloaderwdc8loaderratformbookpersistencespywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2