Extracted

• • Target

    3710157828.xls

  • Size

    980KB

  • MD5

    ca9c41409fb6b471bbe34d827fba95db

  • SHA1

    019fbacb2125688b425dfee241fd7be49e9ee94a

  • SHA256

    f06916db4ff1854630b29191f3a41251cdc97ab00a543c777dd5890545cca07b

  • SHA512

    f06d36cc80ee067d21a0d126ec2dcd31a3d6324bea3ce4750bff637ec65a812821aeec4dd4b7f5a0a9301db3fefbc51fd1e6782cc70efdcfc640092c62ea67b4

  • SSDEEP

    24576:6LKKu9VRu9VQ+MXUiu9V2ho51lOQy6qN2U:6LKKuJuY+MXPuMVQyyU

  Score

  10^/10

  formbookne28ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2