Extracted

• • Target
    SecuriteInfo.com.W32.AIDetectNet.01.24290.23882
  • Size 269KB
  • SHA256 8054dd2e45880794d187893bf7274cb69cc628baa62eec2a2dfb514af50c37c4
  • MD5 d5353394b28c55fb2649da8d66f74cb8
  • SHA1 c6143cadad1adef54b5d7cf7a90035feb3e283a0
  • SHA512 e001b38a85e3be0cf15ecabc5fb20658878cc516a25d36bd6d6ed70c611e130fcf499a9a26aeacd2760c2e109acff0f1055bde6766029e727214be7ec43b4c02
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloadertn61loaderpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2