Extracted

• • Target
    BANK SLIP_WOOHYUN GREEN_HOCHIMINH_EPDA_.exe
  • Size 570KB
  • SHA256 a1fda3d25de841c11ff5dae7f624462a8ee8b66ad97ead52b2d69f88875c3e5a
  • MD5 7866b1b77f6a23065daf812b78f4581b
  • SHA1 0f976a735397d0a62338da376def67fa498d6d09
  • SHA512 29197c1c32db0d606c1e62e0908476b37c27f114530dd382f3c8d41ac4faf0dff08319522dae57003e17efb53fee639e6ddff600cdd862967c88860445914700
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloadera2esloaderpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2