Extracted

• • Target

    SOR-0188-2022-E - Sea Orpheus.exe

  • Size

    715KB

  • MD5

    1963afa9192dbc64dcf0f05a09ca4a84

  • SHA1

    07e68172cf7485b8921739037b3045742d6e87a5

  • SHA256

    9a3a97e6801259fb5c604f364434f5c96c519dc979be88f69488a87e3b1fbd2d

  • SHA512

    fa5a8e76864e081a7b29b7182ee1bc9a5a78f5904e3592a6c6e6027af32713e2bed4e832354e48b367e52a021c2a74823937883afa210c8cc82e2f67b0f369c7

  • SSDEEP

    12288:tVF75e1ZuqRhf5O5zOJf2t51Yy8rZGGWvC0DsD88WV+kOGq+b6e6/U:tVZ52ZB7xOFEDy8r0Ru8LjBf

  Score

  10^/10

  formbookxloader6hscdiscoveryloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2