Extracted

• • Target

    DHL.cmd

  • Size

    6KB

  • MD5

    4fac338e225a33e53806bf2f27f3ed0e

  • SHA1

    5e7f1620ebe0099e2c7014b2e725eefbdaecab85

  • SHA256

    1825ea48164cc22c0872fea1d7ed7698d8ac439c8404207db2234cdc2b95f1ba

  • SHA512

    cdeee8abcf1153740d8d1c0cc82c23c2f4b71fb6335b4fa1c3c5bf4838a0186f8043b3b5223c8d13c62c777be7cb8df2ef12a617485cdf61c527e2d5f5888844

  • SSDEEP

    192:YWFEaVQEQKcwglcCy6XnU/pTmAaelT2dvmf:ThuZXGCyWU/praeIdvW

  Score

  10^/10

  executionformbookguloaderdd01downloaderpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2