Extracted

• • Target
    Invoice DT & Bank Details.exe
  • Size 564KB
  • SHA256 4ed83928e3ee46e2bfdd24cf49a4f0dd49f70911df7c0c6c740ed9b7a407b8d6
  • MD5 79fa65abebd0db7d22ee16fa6c78dcdf
  • SHA1 541804cb1ab784246db25dc68e3e59bd5851c3f3
  • SHA512 1d9f67dde2933e8b21fb25dbd28e207002c40ea75c2689c311ebb24b744c935129e5f9ee8b12fbb9d9e273a587b970110870257eb5c1d3824a9decf89b021abc
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderpt7bloaderratsuricataformbookpersistencespywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2