Extracted

• • Target
    DHL shipment-xlsx.exe
  • Size 338KB
  • SHA256 b9531a6cb2babbc047c7bb0debb17d335b684e484e091ebcf85cb64490ed6537
  • MD5 7c6c5cbacf87c1c8f49427b695c7217f
  • SHA1 58d64edf133aa49598afbd8b9bdfba29349eea12
  • SHA512 851e54b54681af0970604bd2a0a0d1b5f13669b511386feacad06339f598be6f06a3a2533fec5a5680e4aed1057c8e7fd09d5d73c60b6dbe12bba6a21dfa3736
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookby73persistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2