Extracted

• • Target
    Invoice NO 22073895.exe
  • Size 422KB
  • SHA256 f5ae9ee403c63e78514c23cdb6297c09a5367c241f6151def5fe1fc096946de4
  • MD5 dee7396305b42cf03353059427ef8338
  • SHA1 656b2744eed942b4a4659d73813e3bebe704eb5a
  • SHA512 d7b0a4e2f1478272dad605f92137e6cc649d3ffbee6e27710d290c4983a22d3e7bf8f3117c3e3b76c9044cc00e0503f9061454a2faa3d2651fb56323330f4159
  • SSDEEP 6144:oYa63qgvG1/xZGA3iCc34BJ8/BL7jYaMRHajFvC/H2wGy1JBq6Ou:oYNnvKHyx2J8xQvVa4/HBGy1Xr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookxloaderpoubloaderpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2