Extracted

• • Target
    b304ea7c0c21af9a1e1787461fb6577cd05a358fad427a8c33a531449928e700.exe
  • Size 225KB
  • SHA256 b304ea7c0c21af9a1e1787461fb6577cd05a358fad427a8c33a531449928e700
  • MD5 ffd1f23d797e701acd68c6fafc43ee52
  • SHA1 9d50d54229d7b5c77ef2ff5b2e8383d857a72c78
  • SHA512 7ce85f0852546659ff88c74649885599926ad99705afa70403d8f925248c954350b4dec3383e0f9e0aa61ded75b13416dc217eae2064cb3992ed3a67e98b352c
  • SSDEEP 6144:LkwmZ9d0kAbVgQgvIb3w/zpxuDee5rFrTFFkvyIu2:4Z30b8qARe5ZrTkvyk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookxloaderpoubdiscoveryloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    rqpwm.exe
  • Size 65KB
  • SHA256 9713a086074e9951c6ba4aff6f801c62ca11935aaea623047f21c6b1516174ac
  • MD5 c7b994bf4057f869fbf0fdd87058a5b1
  • SHA1 49cd3cb0e992b570ddfb82ee539c91e924fae42d
  • SHA512 b3d511e62c54aa201d00b83e520b714efb295a39030b98558d88b499e90b1d2606ca58dbb3aea4e602912ada7c9582738083ae44890b2a183a262bacb8d1b0d9
  • SSDEEP 1536:BIAqBDA3log/a0JD0LMqkADk+8+mjk6qKrOqzCJ:atA3pHDKM8Dk+Axr/CJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4