Extracted

• • Target
    09e78c601be649601d88efd9cab2d3730176cbb0adc4a4105ec3e37af037e7bd
  • Size 1.6MB
  • SHA256 09e78c601be649601d88efd9cab2d3730176cbb0adc4a4105ec3e37af037e7bd
  • MD5 a1bd77437c6e7f6813b893d8814d58ef
  • SHA1 64f28d1bf3717b380ef1d398f32fc372d0cf43ce
  • SHA512 c14de6a02b042f18588276c131abb4f51c29551ce14c98f75d6240249043525967da3f8b2c3b3555508bd0c07ea1668aec109210f3ff8b4161372f00d2de2587
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderttjuloaderpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1