Extracted

• • Target

    tmp

  • Size

    293KB

  • MD5

    960b0f8219762d17f6f47ee76275c7c1

  • SHA1

    ed0eaa1b2d7636d74713c86548842cdb72b8c8cd

  • SHA256

    b47cf0eaed7e3798e77eaf01aac5783f2c03f7db7802a5215523d4ccdc631bc5

  • SHA512

    06d9751f85266c92e666400dc911271e3354ca550a12a6e45386f46f23c56e02986d8a763f394ecbe470952379a752cb0ab26dee5dcc8d4cab84d28e34104ccc

  • SSDEEP

    6144:eqJT5/+TVlkf7jWDUaLOjYmCVdKrLVi2D9y4CUFHHv:e61+BIjbaafCi/Vi2D9yJU1

  Score

  10^/10

  formbookxloaderzgtbloaderpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2