Extracted

• • Target
    Swift Payment.xls
  • Size 537KB
  • SHA256 eaf3b9c1bdaf72da0a5d2a1a8c4f128712463c558e8af23830126bf07ef63847
  • MD5 3ddbb73564bd5da178d353887cb82cf1
  • SHA1 9e7cfbac422ef392dff72228be57a86f37eed26a
  • SHA512 c4cc01cc620b8f5cf457221679760f5a36e32cf1d2fa42f3a30bac8949bd152ab0097e2ce02da70111533b0b21c43a71200aba97362c0270623a56a2b1d44d0e
  • SSDEEP 12288:pNsZ4UeZzxvJLrl0jHUxIbuKlt70AFg7JzXAZo+r:s2xxJIUgL0AGkb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookb48ndefense_evasiondiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2