Extracted

• • Target
    5th Hire remittance copy.exe
  • Size 503KB
  • SHA256 b01ea964fe231d0b56d71ca6b447a1d51a31530e307227ff44fa8552f86bf3d5
  • MD5 c8c5be1ddcbab78c1e6445ecb20530a5
  • SHA1 99e7cde8be31494e739877882711d5f7ca2794a3
  • SHA512 89485789e7c8769c0485d4f58712dcf01b94f5749b0a9eda8d66280f56bfc1330ecf501554393236a0314f4eb3e23763289be552c1663c8e3110444cf724f031
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderd89xloaderpersistenceratspywarestealersuricataformbooktrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2