Extracted

• • Target
    BL-SHIPPING DOCUMENTS.exe
  • Size 242KB
  • SHA256 221f3d1fe2ec39b9854c584a51fa3cd49f23995f8ae99c8c7d8e2efa85bb38b0
  • MD5 b960a974c1e40499ca7f1489955cf5fe
  • SHA1 489d2d23a982393d00ed22530b7919169b0dbe47
  • SHA512 83aac3792bdaaa2e7c1dbe9d01be68b9b19016496eac95830b2b227b5fedd58b4a15718fe25842c622ce3582aae201a3a4aa9d4a5e28c61979f34f295f7be93f
  • SSDEEP 6144:/Ya6EZbmuHMo4jXs4oYT7C6bg1H2sTBpZfw1edMzJ:/Y6Zbmuhqs7o7C6E1HhTzGodQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbooks28ypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2