Extracted

• • Target

    DHL Shipment Notification 5011586210.exe

  • Size

    358KB

  • MD5

    8ea0022fe9bfb7a53c0650a1991d9420

  • SHA1

    65cca2488da8a1d479e2ef9745a27c7c2495f6c4

  • SHA256

    51e2e890ac898a62cb6478414ac1079df55a036da252026d4f5c8f7f09e400b3

  • SHA512

    c9129be7dcce8b5dd560e7c36d2177c7b5a6a88a41760db693b35d6b0e14d7293faead0c30a3386cd7be8238ac080a8aa59eff6d28a5269f492167a531e5f64f

  • SSDEEP

    6144:zxanJ2WI0ahaqmvK4Cqwpu/e+gnoGpob9cAjkTfpYpPapkSd9ug7x8nInfxD6MR:z8nJ2WI0qaqmvK4Cq/hgoMWcAYTf+pPK

  Score

  10^/10

  formbookmq3discoveryratspywarestealertrojancredential_accesspersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2