Extracted

• • Target
    0d69e4f6_by_Libranalysis
  • Size 38KB
  • SHA256 0c856e57da034a8943b4065297d075365090d9eb925abb7ba74dd3df9acefc1f
  • MD5 0d69e4f684735cf4f187659ee0882fd8
  • SHA1 55a52f6971084224e3030b76cd44d13b0203b749
  • SHA512 9bfc38689030d9100a52d192ffacf7afcf82ec64b40bb34613adaa109c1557959123ee4c261b4becaed28b99c28044cd410dc3f82fc18ab82276311e40464647
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Formbook Payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Use of msiexec (install) with remote resource

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2