Extracted

• • Target

    shipping document.exe

  • Size

    521KB

  • MD5

    557350a46a849eb9ae8bc28a629bf3d5

  • SHA1

    8a773187553730b62bc9ba58457b8a97523f953e

  • SHA256

    576d080b4cab07bd5c3ef3e5d6a222b91744368ed837a3e56eb89772c1b5a1de

  • SHA512

    aee4d4881f1d20b7837f690291702c7ead7c6900f0a68fa29f6c5fbd06fc91d7d13f893b70543c172d3a3732d47262aeca3209af81cc396eddc3dd3412ccad64

  Score

  10^/10

  formbookxloaderpdrqevasionloaderpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2