Extracted

• • Target
    676703938dcc35c7ff494355bc00d067.exe
  • Size 2.1MB
  • SHA256 a8ee338d80b7be8f4e1bc7b6fa10890a9f5575ea4ea8fa3db547f9f0abc22c64
  • MD5 676703938dcc35c7ff494355bc00d067
  • SHA1 70156cc2b5d2b93045c0efe6511557cd00ae373a
  • SHA512 6c06d9ee5483ac4134db3df7c4ada9312eefe57968d52aea4b78a10c15dfb066d681c3ed8a451e3a9815ee30ff652f388d4530a89b462ad9b3bfa3b5884d2901
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloadermt88loaderpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2