Extracted

• • Target
    SecuriteInfo.com.Variant.Jaik.72878.26519.1384
  • Size 253KB
  • SHA256 6b19bf1ec55b55f38c00c74fd66dd45c8d7e12eebebca913c4d21152ed0ced8c
  • MD5 63024416555335f0668d2450f16fed17
  • SHA1 aa758a0388cbdea9894cc0527e5fb1b9bafbde6a
  • SHA512 a21a6a07f626c648ff13523a635dd710833c52496a990e70d7734a6c8d9db16da88bf7c9b2c6c7c3d300e9ade2b2c5221aefd6a252391ab7ae8424d4d7b71175
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderpvguloaderratsuricataformbookpersistencespywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2