formbook | 18fbb515a3120630bcb1de4f827151ef4adc3bb12f8ebc01b0ea9aa8264fe6c7

General

Target
ekli.rar
Size 953KB
Sample260916-pqa9vazgre
SHA256 18fbb515a3120630bcb1de4f827151ef4adc3bb12f8ebc01b0ea9aa8264fe6c7
MD5 ed5a1ba76a8e4855cc01229125279ee5
SHA1 ae0804e930e5ee316b830f26b44d749e506050bc
SHA512 194decda2df5742484d495108e59e583703054c8286da88a6eb56a4b1dbd96470abed6a432f952dc3d7e87f321d20cad68c4b91b26ba38a27186ba7bd39b39a3
SSDEEP 24576:NxAelLZtYbHRNPASY4iepAApJpxYhQ9ZTkqZne5:Ndl+bbq4iM+OR1nk
TLSH
T1E0253369FFD1863F4A980D8131B9CB36EF94E8D48A13A6DA270D1BB71C9D23145B0B31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  ekli.rar
- Size 953KB
- SHA256 18fbb515a3120630bcb1de4f827151ef4adc3bb12f8ebc01b0ea9aa8264fe6c7
- MD5 ed5a1ba76a8e4855cc01229125279ee5
- SHA1 ae0804e930e5ee316b830f26b44d749e506050bc
- SHA512 194decda2df5742484d495108e59e583703054c8286da88a6eb56a4b1dbd96470abed6a432f952dc3d7e87f321d20cad68c4b91b26ba38a27186ba7bd39b39a3
- SSDEEP 24576:NxAelLZtYbHRNPASY4iepAApJpxYhQ9ZTkqZne5:Ndl+bbq4iM+OR1nk
- TLSH
  T1E0253369FFD1863F4A980D8131B9CB36EF94E8D48A13A6DA270D1BB71C9D23145B0B31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware collection discovery execution formbook persistence rat spyware stealer trojan
- Family: Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext
behavioral1
- Target
  ekli.exe
- Size 1.0MB
- SHA256 61b7b12d8ba266e5048fd640bec66c1975f9d047182dffb64681154835d59951
- MD5 830cf77078c5513e83c460f1bfc7be73
- SHA1 34565d92bf238cafcbef1d19a5905877ef61bb97
- SHA512 b7009f21d11b8854c584c5ac5aa9cc5d5320bf825cc4a9651ef346595b20aad0c5b7a3a50b3a0af3e35133536c89eb5e0b1e50bb8972c0fed52196ef15e4e0b5
- SSDEEP 24576:gWCvkgrLbWjfSkNjKIjWptFLmCJ3Vdjw1hF8OaLcB4:sfyjhjApjqiLjwhsYB4
- TLSH
  T15E2501546279AA17F8B767F80635E13407B67EDEBA20E24B9FD62CEB7430B005908713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware collection discovery execution formbook persistence rat spyware stealer trojan
- Family: Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext
behavioral2