Extracted

• • Target

    Invoice NO 22073895.exe

  • Size

    422KB

  • MD5

    dee7396305b42cf03353059427ef8338

  • SHA1

    656b2744eed942b4a4659d73813e3bebe704eb5a

  • SHA256

    f5ae9ee403c63e78514c23cdb6297c09a5367c241f6151def5fe1fc096946de4

  • SHA512

    d7b0a4e2f1478272dad605f92137e6cc649d3ffbee6e27710d290c4983a22d3e7bf8f3117c3e3b76c9044cc00e0503f9061454a2faa3d2651fb56323330f4159

  • SSDEEP

    6144:oYa63qgvG1/xZGA3iCc34BJ8/BL7jYaMRHajFvC/H2wGy1JBq6Ou:oYNnvKHyx2J8xQvVa4/HBGy1Xr

  Score

  10^/10

  formbookxloaderpoubloaderpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2