Extracted

• • Target

    PAYMENT SWIFT.exe

  • Size

    945KB

  • MD5

    58a2b57d6fed01004f9a3836daf788aa

  • SHA1

    c3f3d392937fc4b9603a802808c72276a2070484

  • SHA256

    dd343e8e8564f63c03e29e51e23e4181817e37f8203f4ec5a8abb9f6ca21a7bf

  • SHA512

    0cdb854bff03250a52126e987112a53a44d55c5b8d3b7e79f2a01001edeb7b89375082b1891faded95e507b48f7130665a50842e535c6c6b4ecb8970ccf7fef0

  Score

  10^/10

  formbookxloaderbe3sloaderpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2