Extracted

• • Target

    b3516494_by_Libranalysis

  • Size

    37KB

  • MD5

    b3516494fe6955136ea6e6c6a6dfa6a6

  • SHA1

    c982a59c2578f1892cef4767299b7b64527c75db

  • SHA256

    f168b37d321935ef09ef0dc2f12c85069c032da1116eb2736320f243c728c407

  • SHA512

    9dc052bfaa1485daa6510a65a8b484eb1a21348033ee84ea57b0fd6f8c71c713b198cefb010bbc06ccba5944bdb6ce7cf66496fccdc4ed34e7b3919770ad765d

  Score

  10^/10

  formbookratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Formbook Payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Use of msiexec (install) with remote resource

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2