Extracted

• • Target

    Shipment Document BL,INV and packing list.jpg.exe

  • Size

    323KB

  • MD5

    858a0b8a0c24df21ce22f3ff702a3737

  • SHA1

    f285429ebe2a75c143abe1fd579c979122c6afe0

  • SHA256

    88819addd430324a7461bdf59c1ab994bc613bb2b17f09e572b7ba1c0c47e6f9

  • SHA512

    cfdab69ebe17d666b05a399c935a28f411a9bc1a5c014dd1fa533043992b7a947d6417982011b9fabc76c21d2d294d6384a2157580fc30b4ef46e53eb0c57ca7

  • SSDEEP

    6144:/6dbOGzzzzzzzzzzzzzzzzzzzzzzzzzzzzkzTzzzzzzQtkauL/sVfEBlUbrQ2Inh:itka2UbrQlZI/JTV6V7KAF

  Score

  10^/10

  discoveryformbookd06cratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2