Extracted

• • Target

    MAERSK Tracking Document.scr

  • Size

    924KB

  • MD5

    3a8f82508c711f924c54faa42d31a59a

  • SHA1

    b97dc139f2d5027e74f03b1ef9e0949a83d62c54

  • SHA256

    54bd1e36470a85b388bf211308b661eb8f6cf52300ed006a8adaa3d9d087cf9d

  • SHA512

    288aa5b52e6082c383385003b806bf75d9ef17990b3fc6acb5cac5e20710b4a0125729d556a907336269c778fc5bd283c2b2d606230f4729f1515be2d5e69545

  • SSDEEP

    12288:AiB4sLf+BvqbT+ZJjHKqrKdLazzSYCUZRFRrKdFP55FW/Bw8ytA7RATi+esTCmf:AiB4PlFJWqQLkJezjyBjytA7S2mf

  Score

  10^/10

  formbookchu20bootkitdiscoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Deletes itself

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2