Extracted

• • Target
    D21349_R01.exe
  • Size 368KB
  • SHA256 b1dd2798d89f66d87e984ac3020a0ddc6741c6a845fa6df3d5e3a27ac08e791d
  • MD5 8257cfda4bcf7f729bb54f202c2fcbe8
  • SHA1 a92d8320d2c0b25bb519b4186c1cea1bf106c049
  • SHA512 9a6bf3c40d59ac40ef1d7b370dd12cf8ec207693bd3ffd85daf98aab6de7f24d13e0364558d511c31d1965adb024f04375a7ff0c4035a859ea2ce06c7a6721fe
  • SSDEEP 6144:h/DDAs9TKoUjNVl6tGrFWGDvtww8Yxw7YURz6t776Qgl/u0O0:h/MoUjNVl3rkGDvtww8Yxw7Yf7n0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloaderd0cediscoveryloaderratformbookpersistencespywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral10behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9