Extracted

• • Target

    b304ea7c0c21af9a1e1787461fb6577cd05a358fad427a8c33a531449928e700.exe

  • Size

    225KB

  • MD5

    ffd1f23d797e701acd68c6fafc43ee52

  • SHA1

    9d50d54229d7b5c77ef2ff5b2e8383d857a72c78

  • SHA256

    b304ea7c0c21af9a1e1787461fb6577cd05a358fad427a8c33a531449928e700

  • SHA512

    7ce85f0852546659ff88c74649885599926ad99705afa70403d8f925248c954350b4dec3383e0f9e0aa61ded75b13416dc217eae2064cb3992ed3a67e98b352c

  • SSDEEP

    6144:LkwmZ9d0kAbVgQgvIb3w/zpxuDee5rFrTFFkvyIu2:4Z30b8qARe5ZrTkvyk

  Score

  10^/10

  formbookxloaderpoubdiscoveryloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    rqpwm.exe

  • Size

    65KB

  • MD5

    c7b994bf4057f869fbf0fdd87058a5b1

  • SHA1

    49cd3cb0e992b570ddfb82ee539c91e924fae42d

  • SHA256

    9713a086074e9951c6ba4aff6f801c62ca11935aaea623047f21c6b1516174ac

  • SHA512

    b3d511e62c54aa201d00b83e520b714efb295a39030b98558d88b499e90b1d2606ca58dbb3aea4e602912ada7c9582738083ae44890b2a183a262bacb8d1b0d9

  • SSDEEP

    1536:BIAqBDA3log/a0JD0LMqkADk+8+mjk6qKrOqzCJ:atA3pHDKM8Dk+Axr/CJ

  Score

  3^/10

  discovery
  behavioral3behavioral4