Extracted

• • Target
    27fe38ce70fca4c4526c07a42449f11e
  • Size 260KB
  • SHA256 fe55fb664c32bacbd76bf8859a8a2cd17f23d21f08a22ac9881cb0fa33935990
  • MD5 27fe38ce70fca4c4526c07a42449f11e
  • SHA1 cd9243f1b525d08290f1bb2c428235a40e0a423e
  • SHA512 d68a45d7c19e2a13da3e68b17823578e4e0cd17e949931b90d1fb211ffee3d46f90acf28e1b93b76435c6f8c5da4050150e993c8e7d6a4d5af5114702d155d80
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderbe4oloaderpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2