Extracted

Extracted

• • Target

    Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe

  • Size

    1.0MB

  • MD5

    af4c90f16183a6ad67d309954e852c8a

  • SHA1

    4b8612090c079bf462c55e774c7199d4f182e937

  • SHA256

    e42dddf5106613702329f2fa39feac15baee21cd5b543d288dc82ed621eb7037

  • SHA512

    c335c1ab1b2708530424dc094a9b864155275e4d462bf726b38338b9c33f6942c355b9092fa786bf1a20f99c7ac52b4c03e399ff5ab157fff556480db15fc823

  • SSDEEP

    12288:0oQgKZ/nXt7virmWhlGLaQYIyzYEmgX/Lifi1SXAe73hdw7YVCiJM2dycvQ0piws:fPNNwAe7x78OQ0Hx4xUhlWp

  Score

  10^/10

  formbookxloaderm9aeloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2