Extracted

• • Target
    SR2022061584,pdf.exe
  • Size 230KB
  • SHA256 347b2260600d99e1b3007aeaf18c01e4c5bb1d9f2b97eb371c6d2d69c8ee1169
  • MD5 c181d4072468279090f281c81a1cccec
  • SHA1 4eacb1d04de258fde250819018b5fba93e6bc77e
  • SHA512 ddf8eec7a23289554b1dd863167324dfcf87d1e4d9caec97fe1fdcf56c2cf1a3970fc78d795ea7b3eb3b47c673ba485c7492883224f3323319f739c9d186f4a2
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderuugsloaderpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2