Extracted

• • Target
    914134bcfe78473c6647d785ceea3235.exe
  • Size 562KB
  • SHA256 9afa5a53a2f68b1eb6dcc22a14b1b23e03b02da4a5501d7e7cbcb0a4d694f55d
  • MD5 914134bcfe78473c6647d785ceea3235
  • SHA1 791ea911e79bf1768916ca599ca4cc5a9f2a8817
  • SHA512 8c01141c408aee459452c1d30dd4d5e2b2ced2552f35076a3213d632fe9ce253fdae4584f395ce69f29b772c1c25c4972d8a802aa6328baff4e79baf2d935b6d
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderc0a7loaderratformbookpersistencespywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2