Extracted

• • Target

    814e1a31a6bff8df45a6393430e9c0b7bbaddafc

  • Size

    37KB

  • MD5

    ccaacde2a2fea467aacb4d46c0f6d92a

  • SHA1

    814e1a31a6bff8df45a6393430e9c0b7bbaddafc

  • SHA256

    c2c6534ff0fbb2099535e54323aec998d82de2811f6fd82337927c9d866e01f4

  • SHA512

    6592b22bb684fa3a47f33f666c6a3af666b59052adbce1088dfa9031b1f862328ba3d533f03abd3e47fe34d5d05db2873feeec8dae7d08c23bc88cb51b4c19ee

  Score

  10^/10

  formbookratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Formbook Payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Use of msiexec (install) with remote resource

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2