Extracted

• • Target
    DHL Shipment AWB 5214910007391.exe
  • Size 619KB
  • SHA256 ebfb1ff1b4c2b59183abffb8fbc8fd8271d0756868ceca9b72b26cfee8030ec9
  • MD5 04ec1b30b15bf7076a9892be1dae11b0
  • SHA1 ec7f0d6d7b5af8860f338ea1c3a67d35b12a5de8
  • SHA512 38fb1a520d3e6b1ac1c638f0c18683eb7cf00c633a66b44c027c4e889332da27c1e93a9250b38eb67d87f9e85694c81dadb0f69fbc00da88483c8a791cfb5396
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2