Extracted

• • Target
    soa.exe
  • Size 733KB
  • SHA256 29e01694dfdb882f3922844f2fa640eb19fb99ff1179ac378df15b45fac32f11
  • MD5 430cb910503e0fb17dea4259ad82e0c9
  • SHA1 2a6d2f9521ff771c5320719f7142ddec7163e2b7
  • SHA512 1cb05ab896d6f2ca211d25242fdf515ce7399e53bd09e697f621a6bc911a0ac098e9bfe3d5cbb623629e3ca10d5474d429bc8c07ab2a07d02f6c1fa9ea2dd288
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloadera8hqloaderpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2