Extracted

• • Target
    1be8992516510c76e9fde44f9ee1ea75.exe
  • Size 219KB
  • SHA256 434655800ff8d745df2462881f0fe044f2af72512217dd531beffbfea0e2b1a6
  • MD5 1be8992516510c76e9fde44f9ee1ea75
  • SHA1 4e82d22440063a440415496e8b34af6330c57312
  • SHA512 0b6b16e8c3106df063be53f0468849f395c59ddfb87f121900bd34fb4c6406d5b5e9af2aebeb6ea3197671b66ee67fbef0c50013035afc559cb3acf35c5863ba
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderud5floaderratformbookpersistencespywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2