Extracted

Extracted

• • Target

    SecuriteInfo.com.Win32.TrojanX-gen.360.32285.exe

  • Size

    824KB

  • MD5

    4575f347077760e1257159f74291fad0

  • SHA1

    d65c9fa35db54403c42b2731f6c616317eb23b78

  • SHA256

    109ab3837f865b4ba288ca4a1fa4e8d416c04b3686376c55128553d4a4db55b5

  • SHA512

    d238fead3b0efa0c6140f587b1d9ff9a9b7298189d6153a3d53aaeaa95b440807e9871ed60706e85c5f396f272ce6ab548184a0ba64c9f8e7b04300fed96936e

  • SSDEEP

    12288:88xW3p8fe9EgNBWWJXVy20V0abqYU3K4j2X2Er5OxG2:8xCfe9EmLJlNIF3RXVr0G

  Score

  10^/10

  modiloadertrojanformbookxloadern7akuj3cloaderpersistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Xloader payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2