Extracted

• • Target

    aa9db27b2063f5aee9f97d7d86b883686f51bd030d0b38d6daaed3629a230a7d

  • Size

    271KB

  • MD5

    f9a20cce97d6efd9e8d071420a8858b7

  • SHA1

    17680094e9bdefe2f5205729f2b55be2ffca81fa

  • SHA256

    aa9db27b2063f5aee9f97d7d86b883686f51bd030d0b38d6daaed3629a230a7d

  • SHA512

    fb9055d9f19788e0c2d25f3f400165b630ef6f62604d6ee6a764c7a57f5f115737db4187be30641bca16af11d84d3afdde73b0790f5d43f682e10439ed7a1026

  Score

  10^/10

  xloaderp00nloaderratformbookpersistencespywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2