Extracted

• • Target
    Confirmation Transfer Ref_MT103_0023456891099200301019898.exe
  • Size 460KB
  • SHA256 fc8dedb234d17ae5d5e58eaf372988114b82bd1a9defe9934e8d7738e15a88ab
  • MD5 3400578649e2a279e6c7cdf89fbb583c
  • SHA1 7a0a5f4712f0dc9a6e422406b905b5137421dd6c
  • SHA512 35263b3a894158b59febf4d4c228407e51f2082e70891e3423878a9f47047496f1d3975658dffd10bfc80952e5748f3a8f8dce99e091b0f7e7900ba9d80953e5
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderarnaloaderpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2