Extracted

• • Target
    Angebotsanfrage 86548.exe
  • Size 365KB
  • SHA256 e6cde5c1b614549613d30761b34c899f4ff69d7e6e3147c21d68bedd64f8fe25
  • MD5 5b4f0a86299caa8167044e4c66254290
  • SHA1 42a66629f75716d56790a610c404294e288224b1
  • SHA512 3fecdc807f1b49a94794f5c37883df9d8fefafa63c94fe8e6fb3156cc136a1f5b50e601e0f2cd2339cf1830a31b2bb7eab25f281971006d4609fee2190755646
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderou3tloaderpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2