Extracted

• • Target
    tmp
  • Size 611KB
  • SHA256 40900faa35256d3ac7ec7116099f42a085244ecc802e9cea7522a7707eba7b62
  • MD5 da0fe038092ffec4ea327f0ec0d0c290
  • SHA1 d8bc98b32215c23d8b35bd998f3cb797bea58cbb
  • SHA512 5c5625bd6d5dbc27e4310174f5bf83a6ec57c65e02911d2f9c101e7b7cc65aa0e7fbf82fb62f391f0f67b5a0706b8aa91ccfa6b9245083779bac4efc737459fb
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadergd9mloaderratsuricataformbookpersistencespywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader Payload

    rat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2