Extracted

Extracted

• • Target

    4500295678.bin

  • Size

    763KB

  • MD5

    0294badebae62dd7e03d329fb35b2395

  • SHA1

    e44bae4b5c71c79a11c22fe97d45bb027822b4cd

  • SHA256

    7d51363f1fc990710be0a463a7123a5c5cbe532e81164b1c43d4a159a89dadeb

  • SHA512

    fd53e307148a44af3c03025591bfe7a5e6e95daf25dc3eb089f2c4ebdedf1357ce1c4f7970c56ceba3cacf04caea53acac242d21e296126316d98cdf369157e8

  • SSDEEP

    12288:gTkSi8uZXy8E6AvHiCx62iNOIFDWfAK1LkD+4oGN/XgYOHK6+kLcz3hi3pm+P0/Q:x18uNy8UaC619FDWIXy4oGA3+eY3hkmi

  Score

  10^/10

  formbookxloaderzzundiscoveryloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2