Extracted

• • Target
    NEW RFQ ORDER 8765224.exe
  • Size 530KB
  • SHA256 0e7ba6c8acc0e3de5a31e050eb287daba683c992e12c4715730ef3ccf3bbf575
  • MD5 698cb16365ce9ce1781b674a6d9c7e1d
  • SHA1 27b9cec0783e2595822a322c1cc6ad7373f5cb92
  • SHA512 b8a6eded6d93033f179688aa04dba398ad4530b7faed2ca5d936e7362194cf0e991274eb9910e604ba5a85bc026c22590f3e915d2479419a0c8d6e8909669c92
  • MD5 SHA1 SHA512

  Score

  10^/10

  agilenetrattrojanspywarestealerformbook

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Suspicious use of SetThreadContext

  behavioral1behavioral2