Extracted

• • Target
    PAYMENT_.EXE
  • Size 240KB
  • SHA256 4b9c6211bbd01950f10d8a2ea7ac75ef380c1d4f88a1b5a9e55b6fdf09d3f603
  • MD5 59e0f7de7669e7839cf29bb73434f2c3
  • SHA1 749079b62d1ec92c6d4abe1ca9a7a02547c10d15
  • SHA512 0f4806b67eaee33ad85a930d636eccacf5b19492e7f48b27fab5518be47e4d8f4e5a3ee03cd9ea60fff2b0da20e5e0f4eb54c8b219db0278894bccb099dc0379
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderfew9loaderratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2