Extracted

• • Target

    INVOICENoKTSPHIAUDIOdocx.docx

  • Size

    10KB

  • MD5

    10fff05223ad6d1bb04774da72f1d815

  • SHA1

    c85b33926aafd563649ae22c6506212591d36b0a

  • SHA256

    94e3996206fdc70b2ed95a87672b3516eac8a41d25c2c3659ed7933399bfa287

  • SHA512

    3fb1aa53fbb6920a6f4fbc33cc176e2842f3c3634319741183aaa6aaf5741cb960a352322b5d2263b877026b699764b4e214746c074f91a58b39820ed36acb17

  • SSDEEP

    192:gya0NI0ZmW6ARgZVPCK44AG9xXSJ+Ej70JY6KwHKcpkWY8cWeZF:gyXI0ZmW6ANK4499xXSJf70JY6H1Y8eF

  Score

  10^/10

  formbookm42ipersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Abuses OpenXML format to download file from external location

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2