Extracted

• • Target
    new order inquiry.exe
  • Size 530KB
  • SHA256 b1c87bb82c46e28ccb5188475def1c24b3239f0508372163cd75d2abc6eaf049
  • MD5 ad53fb0296bc9beba3c63015f90f2821
  • SHA1 206548a47e53d5f50bb5bd08a0101f79b96c70c3
  • SHA512 3f1e09cc0fbf4dc51f810ac2775b370ee3f1466241dcda26e9e54bed0f2283caad5d5940995a051fa0edec4c0aa69840fa6381d3b10b621741dd69c01dfc0b17
  • MD5 SHA1 SHA512

  Score

  10^/10

  agilenetrattrojanspywarestealerformbook

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Suspicious use of SetThreadContext

  behavioral1behavioral2