Extracted

• • Target

    DHL Shipment Delivery Notification 18-7-23.exe

  • Size

    630KB

  • MD5

    d497e7689faffe7f4b58354d70ef5fcf

  • SHA1

    e608aea6d75cc78ba127dcc64372f9ea6865cd4e

  • SHA256

    44b4eef8a260669a21c64f95af4c5ad884b77fc118be9ade37dad2b908a37bee

  • SHA512

    1bdda51e1c77457459e4e43d8bde4c88f03cd22df4d0a0b06cf19c789612a19591d5335e4777caf0efbc010000b1d17bafc93c458fd9d396958a6f4f2b7d6941

  • SSDEEP

    12288:hmAY2kcdbL4EfGfWjBeeiSi+9R9obcLY4qt3TjfKiEeS3xjl6ayy3:cN6GEfGfWjBDiaL9oI07tDjfseA

  Score

  10^/10

  formbooksn26ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2