Extracted

• • Target

    d036c4b1a4ff6265030084d453558c56f6a2d19b5a6af25943c47bc96895891c.exe

  • Size

    330KB

  • MD5

    58a93d1d064b9e8265ea798531adb0bf

  • SHA1

    d5e30f238fabd304d30ba2c726c71fb47765b494

  • SHA256

    d036c4b1a4ff6265030084d453558c56f6a2d19b5a6af25943c47bc96895891c

  • SHA512

    c5e9c0e07ea8904a45011380836ff8f0b936954729df4fb18f62414322f5815ec8ebc5803729a13b783cf87a5bd723fc821405e3579e017c7b19059e57f76bfb

  • SSDEEP

    6144:PYa69K+mD7y0q2hhBCH4m6Qx8qQ5+/ucZiE2TZPwc7j0W6KmZE0HOkv/kBa:PYnUD71qc+6Q+qQuu/Tn396KmLDv/

  Score

  10^/10

  formbookxloaderpoubdiscoveryloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    xnozsgld.exe

  • Size

    253KB

  • MD5

    d8394c44bc790e1bdab00823f689c1bd

  • SHA1

    735d8986424e2ab3440f49a7a720ecaad43d491d

  • SHA256

    234d80febbdd23b49a2ff5db4e51aa33e82cd77ff082ac6e8f32078cdd701007

  • SHA512

    c6dd135932d86f6a7ae2b82045e024fddad3ce7286672c134e8314d2a7a003d237b4b62141b67c7947e6ca1fffa78047e015c5e714cfb56739ef152485cd559e

  • SSDEEP

    6144:PeQMr6OkeAHYS2FwrkbibMLq70y3Ifos4PLQkSAagi196U51o9R:mQuzkeAHYS2Fwrk2Is3IfoT9SMi196Us

  Score

  3^/10

  discovery
  behavioral3behavioral4