Extracted

Extracted

• • Target

    Jyoti CNC Automation Ltd.exe

  • Size

    386KB

  • MD5

    76546253ae7de8218aaea566454db844

  • SHA1

    fdeef99c922f422a1d49e7d692391a1afa1ac521

  • SHA256

    dd6ef39d8ed08e7355551c7140b5094d57f5c1bf70549f686ca18b9b1698e468

  • SHA512

    2d261ae2988644b7f0d033dda3aa0309f9f895d50d1539053b20702cf43adc6a1c5484bcf0b3b8ab6ffc7cd16d207c9b3ee518506783da525f2f91814942d1eb

  • SSDEEP

    6144:hBn7A5jMUCoQxOXdAwD6D7OUg00HsWFyChk1ucywA+EpxWGFjSHl:vrsXd1O3OUfDWFyChk+wA+ER2F

  Score

  10^/10

  formbookm9aepersistenceratspywarestealertrojanxloaderloader

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2