Extracted

Extracted

• • Target

    fb4fddb4cbdf4cfe8a3c658c6634d4a1d653f9fa61c4ca2ecb069770bf3cae57.exe

  • Size

    225KB

  • MD5

    c20af4b2b3bcb4bb82ef4a78818caffa

  • SHA1

    ddc2f854e96e649a300c6cba5bc8d57d0af8de58

  • SHA256

    fb4fddb4cbdf4cfe8a3c658c6634d4a1d653f9fa61c4ca2ecb069770bf3cae57

  • SHA512

    e53b8819e810d853f2fdf86e129058b096df025bdcf8ec308d8f69b796b911f52f0e1c60431654ac03caf081abdcbef807cb664f6581d6ff61ba9742cf2f33ab

  • SSDEEP

    3072:qUJoFfWzzl+cSMY7xIsqoh3vpj+WSuW2x96i6e4coO81ju5qoRNir+QKQqjQgWmA:qweEpGxj9pHHeFwVNr7jzUBWnk/fZ

  Score

  10^/10

  formbookfqsuratspywarestealertrojanxloaderloader

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2