Extracted

• • Target
    bank_payment-doc.exe
  • Size 241KB
  • SHA256 ea02ed6d1f37b7f0fd8b2f02ebf1b41ba2ca81c755f3590f95b509f45f45ae21
  • MD5 49cfa6f52d1d5c3f838974f1b059ef4d
  • SHA1 60938e875fa766889568d982e21eaa26eb13c7e9
  • SHA512 84df2a3bfc830725d368178d4f4da3322a61527661f12466a4ccbbe8fbef866efcc3b50102dea6bad43ec29deb181dfbb1a56317e8bd50b3bc9ba2ab96ac6a9d
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderu8pgloaderratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2