Extracted

• • Target
    Shipment Document BLINV and packing list.jpg.exe
  • Size 160KB
  • SHA256 ace7e59fa80a108d4f3fd0a56a99f03d17e56ec2c756092aa65b910352f59921
  • MD5 43e358c57ce367fb308c9c9e41c3820c
  • SHA1 aebd72eb5bdd02500e025d66f88a2c402123be4e
  • SHA512 c1569b9625486b15b20247f8e0875acb4144dfe0d90770c958997a7061812abd6b67dab797e485a6e8ef8fa2f0cbb55b171cac6b0afbea4de57e961a405fd13c
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookguloaderbur0downloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Formbook Payload

    rat

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Deletes itself

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2