Extracted

• • Target

    COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

  • Size

    1.1MB

  • MD5

    5ec011058b0884bc3b13563f97231c58

  • SHA1

    9846a460d630ea60c476df6dc92ae10d902bb54f

  • SHA256

    bc5a7642799c2f22d513dc19fb87848ecbe002f1815b2d5fd3a5af3fdbcdf0ae

  • SHA512

    d3172fe1fc90a3e8e4331bb4eeae03377825e26a815636c8931890fa9c1f8290eafa8c293e22b218d37f79a9202e62c5a5b13df40a14ebb828814a3797262523

  • SSDEEP

    24576:gqDEvCTbMWu7rQYlBQcBiT6rprG8apamXjozThdab7:gTvC/MTQYxsWR7ap7wn

  Score

  10^/10

  discoveryformbookjd21credential_accesspersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3