Extracted

• • Target

    shelamas3.1.exe

  • Size

    511KB

  • MD5

    7994c54a4717446039c90d9f5e63d4ce

  • SHA1

    18f5bc70c635da9b95e47898f0313758e225a380

  • SHA256

    037d18a0489c63d5d9ba87f8ea9652c511df0787eb9d8fe361cfab7f93e03582

  • SHA512

    69dc8129beeb15632ea7ea8c63d95bd1a08c8fb3aaacf7344d3ec01bd9efd9f5e6f4dd9e540c159c83a25bcf0003caa57ed944351e6a20c769e124302a0ea5af

  • SSDEEP

    12288:nEUfI55vi6nBA+FrSbH/PJ8jevCPyyYmYj:npYnnBA+FG7/h8jeKPtYtj

  Score

  10^/10

  formbooksk19ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2