Extracted

• • Target

    8df5da115c8287798fe9d01446bcad9e56020c15328257b305503f77ce1b8dd9

  • Size

    458KB

  • MD5

    b9d18f0b735dea8d38a0b7cc9db54546

  • SHA1

    46b618a3134e02b343536c3c35fb44c64d1150c4

  • SHA256

    8df5da115c8287798fe9d01446bcad9e56020c15328257b305503f77ce1b8dd9

  • SHA512

    ac92fbe7548d7eb60bc2232497ce08fbea5eed4d5a6ac488ff8a89d7d80b51392dec8012d935b81536bf31d36a521302405a85a34c3c908111f67ce4839a832e

  • SSDEEP

    6144:ZxlZd712A3TemiYjAKD+DrL/f01XcnNRHolwNADBuHzo1N8L:Hl7oE7iCAc+/L/cZPlgSBuTo1

  Score

  10^/10

  formbookxloaderah5gdiscoveryloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2