Extracted

• • Target

    PI2009153.exe

  • Size

    435KB

  • MD5

    2261b6b87980a9fe9d22499c32af581a

  • SHA1

    ad538af5295f9b670f3bc23c6d4c3bf79d388572

  • SHA256

    a6ec6fd1e4c0673bde9231a68752edca4fb9fda60e342cd735ff53729d262da8

  • SHA512

    600416010f13514e3faa2fdda94df93ae89b6f964381ee02c1a9a982a6aaec2c823bb7235b57bee33ab5c8e07f89293c1ca988f9f772e5da207f3d8336fcbde9

  • SSDEEP

    12288:aZ41MVuZj2uUPrxLfCl2/reQIh2+J6tzyvscuPbR:aZ9VUfCrxjCUeFh2+JWuvscER

  Score

  10^/10

  xloader8ahdiscoveryloaderratformbookpersistencespywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2