Extracted

• • Target
    Consignment Notification-  705643291.exe
  • Size 226KB
  • SHA256 6a7b8ed7f2cfe7f8a3030df54f1ba443025c54e5a15d416469aac2a696d7bf1d
  • MD5 a60cbdaf4f35894d7970f9bcf606acfa
  • SHA1 fe4a22af06fb8d122065dfb0683a7dd9c6baae9a
  • SHA512 7b9822089f6251b116e589140473e8f671568bd45b954c505ab77163210594fd4a4b0905d9dce3b601d50ee217e8f4c06f9fc05cae84873b2498f8c1d3d7b323
  • SSDEEP 3072:QEhKzShSycSMIZLq4ziw2z2nsfvTdob43u27OP4XrefAKNdOR6XgrhedPZphUYk:QBn1Ig4DvNb43m4qO4Qr85k
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookyurmpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2