Extracted

• • Target
    Purchase Order.exe
  • Size 510KB
  • SHA256 a013267b2dae410a6e166f9faaceebef0324d4b9036531856f10275f30ce41b8
  • MD5 c0d6aba1944e05446c8589d0add13e16
  • SHA1 804c051f00fecabab909b845ae9def8231572967
  • SHA512 50fb56803be91339619193cf621bfda489eb58d5757c64674a2b7fb95abab2916be4d90ddf32da13ee299ba0d272713a0898828792667021f085accc086770dc
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderutg6loaderpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2