Extracted

• • Target
    cZAFQY1ivxT14o0.bin
  • Size 526KB
  • SHA256 06cc2d206afed5e79426d726b19ca9ae4dda8f5ed252bea54204aed24433831b
  • MD5 fdfcce551589979a297b003bed5ac9e1
  • SHA1 9d209f5f1b696ed695a28aea018f7179d7a795d2
  • SHA512 4f85b4f8c7095c20c209c9104a81cea33b220e712851acb6b051af251f411be1b9c1540f50029c02257cbbaf1d6f31d3dff2b32dfe3965a73e0aa2b2453539d1
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderg3wsloaderpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2