Extracted

• • Target
    6605701.xls .exe
  • Size 543KB
  • SHA256 62afb1cbcacb77aa2ca99cc55c0e3536738415289f53c4a3a57d9b9cc08ee5ab
  • MD5 38a00ca13354ab0a81921c70f57003b1
  • SHA1 2c113263ab3ae8a9d8cc8fd717f2eefa98c6a65a
  • SHA512 05bc9fb368086401e87a1253f03640005ab744fe7c59ce7134bc1cd4363974713a1e7244378e39493bb6e2a46f6d68b0974f63eee2f221909a1c7edb8fca75eb
  • MD5 SHA1 SHA512

  Score

  10^/10

  agilenetratpersistencetrojanspywarestealerformbook

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2