Extracted

• • Target

    scn14092020.scr

  • Size

    380KB

  • MD5

    f028d6c9991258c5c75e9f234d4dee79

  • SHA1

    2f6b7f76bb4a3342f3450e1cc9ef539c2028c59e

  • SHA256

    576f0ed5ae69ececc1bb11492479101c0281af46cb86a73eae9195376ab02717

  • SHA512

    d3fd7200dad40ce073d477205abf7736e9aa9aab492fec1f42c318f65c2a9e132ab45d6b9c52fa3d7c535db63c392d370e2ee2b4787845c4f5f5408ba352f8be

  • SSDEEP

    6144:Jr5KTzUvCH42ZGb9XF1csV2DoT/oENADXgjDxGXMSwGxDUxQTf2ujAhzs7g8LX9:Z5KEvCH4kGvqfPrDg3kXMitohz38LX9

  Score

  10^/10

  xloaderd9s8loaderratpersistencespywarestealer

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2