Extracted

• • Target
    SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.8452.17207
  • Size 418KB
  • SHA256 4ac982ea35522a13de30ff7ddbbec9becf2c7528a48f0aff377e3d6758a7ae7b
  • MD5 14848f52302c15e27b26fee5fada11c1
  • SHA1 04d62d915bd1a81c4b5ed35df6edb953107398c8
  • SHA512 aee08da4569bc969db4c086cb89950e311aaab9bf94677d9ba532b256ed5a29cc5942d48ca7c58ec8bee095d8e84b1f91935d61a9c601e1f9950c93a4ddd99c3
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderp0iploaderpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2