Extracted

• • Target
    48d4eafd1412fe11e58cb6778be9a6cc.exe
  • Size 285KB
  • SHA256 a7492a3e2caa18c09290209462772d7356966ed9fe91f86830284d950604b300
  • MD5 48d4eafd1412fe11e58cb6778be9a6cc
  • SHA1 4df1a667d1c7de90a5492146b92ffbb667d689a2
  • SHA512 5a34f30f6c9d9d92938f9a357454095ee8421102de1fcce5abb827a2468f7f4050178810d0df16a7174832747453f4218a41e70388195534a93f860cc97bc2e4
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderzgtbloaderpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2