Extracted

• • Target

    E-Fatura000000000382920.exe

  • Size

    574KB

  • MD5

    e93ee7a71781b3a3dcf2f950ce1de7ee

  • SHA1

    7157241ac402a3ffbab5082f6903cb816c1cbe16

  • SHA256

    80402770a7a4ab721bd8c0f964330035e0bbd7524995c26eed67990b6915c3c9

  • SHA512

    0c50b475e9a198166f0496a938b650f3f048042df2ca6e7b0e92f80abb5dbb983514ef73ccbe8743e6e7fd57e5fea002383185b7633e80d21b3f6386a0e428ca

  • SSDEEP

    12288:dqCZOhL2k4zUQWkKLMZckbYv9QwwC1zzjtYARJU/dQ:dqfoW1LM7bUSwt16d

  Score

  10^/10

  xloaderwar0discoveryloaderratformbookcredential_accesspersistencespywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Xloader payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2