Extracted

Extracted

• • Target

    tmp

  • Size

    311KB

  • MD5

    db102a67350060a1e967aef81118f18d

  • SHA1

    a3131a3df17a154e41c09973ca8a9aabac29929e

  • SHA256

    98420cf47e19574739cff3f1f74bd3c6c70e103d0b28040b64fd3c77588c7ee7

  • SHA512

    daad205a305f7774164f0ed2298501e8a4cade236b93f63db31e40713a66a379145a2e9ca861f8c337dcb5e3a29cbe50b1b77589941e1e1c7090c950766de7a3

  • SSDEEP

    6144:NBn0ph65gGns2YvYPUaC55QAU4wVdsTbUi:EpoGHiO554Nbwb3

  Score

  10^/10

  formbookxloaderdwdploaderpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2