Extracted

• • Target

    D21349_R01.exe

  • Size

    368KB

  • MD5

    8257cfda4bcf7f729bb54f202c2fcbe8

  • SHA1

    a92d8320d2c0b25bb519b4186c1cea1bf106c049

  • SHA256

    b1dd2798d89f66d87e984ac3020a0ddc6741c6a845fa6df3d5e3a27ac08e791d

  • SHA512

    9a6bf3c40d59ac40ef1d7b370dd12cf8ec207693bd3ffd85daf98aab6de7f24d13e0364558d511c31d1965adb024f04375a7ff0c4035a859ea2ce06c7a6721fe

  • SSDEEP

    6144:h/DDAs9TKoUjNVl6tGrFWGDvtww8Yxw7YURz6t776Qgl/u0O0:h/MoUjNVl3rkGDvtww8Yxw7Yf7n0

  Score

  10^/10

  xloaderd0cediscoveryloaderratformbookpersistencespywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral10behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9